diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index c991e648d7..7ed08711ab 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -28,6 +28,9 @@ references: tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,6 +47,3 @@ tags: - Registry.dest - Registry.user security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 8193070f70..73acfefa3d 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -24,6 +24,9 @@ references: tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -39,6 +42,3 @@ tags: - ComputerName - User security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 7f23ef53de..c1106006cd 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Cobalt Strike + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log kill_chain_phases: @@ -49,4 +50,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 2017cc33cf..fcbca28a76 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -20,12 +20,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection. +known_false_positives: 3rd party tool may have commandline parameter that can trigger + this detection. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.conti tags: analytic_story: - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log kill_chain_phases: @@ -46,4 +48,3 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index c6ac90e8f9..175dd441d6 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -27,6 +27,9 @@ tags: - DarkSide Ransomware - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,6 +45,3 @@ tags: - ComputerName - User security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 60d457ee0e..f3112ae042 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Discovery Techniques + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: @@ -52,4 +53,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 29457b304e..053214f054 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Discovery Techniques + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: @@ -53,4 +54,3 @@ tags: - process_id - file_create_time security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index e48b741092..2e22aba088 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Collection and Staging + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log kill_chain_phases: @@ -46,4 +47,3 @@ tags: - CommandLine - Product security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index c680170fbe..d66e0892fd 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -33,6 +33,7 @@ tags: - HAFNIUM Group - DarkSide Ransomware - Lateral Movement + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -56,4 +57,3 @@ tags: - CommandLine - Product security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 36e298b533..c769a95800 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Collection and Staging + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log kill_chain_phases: @@ -50,4 +51,3 @@ tags: - CommandLine - Product security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 40a71caa63..55a66bff9d 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Discovery Techniques - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: @@ -56,4 +57,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index cd97b9e36d..cf4a258200 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -42,6 +42,7 @@ tags: analytic_story: - Discovery Techniques - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: @@ -64,4 +65,3 @@ tags: - process_id - file_create_time security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 5cac410070..1271ab6adf 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Discovery Techniques - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: @@ -60,4 +61,3 @@ tags: - CommandLine - Product security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index eaf7807ce6..a205a09ecf 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -26,6 +26,9 @@ references: tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,6 +44,3 @@ tags: - Registry.user - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 73de664b0d..52a5537505 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Meterpreter + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log kill_chain_phases: @@ -49,4 +50,3 @@ tags: - Processes.dest - Processes.user security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 5e9008be07..52dd38f375 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -18,14 +18,17 @@ search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*", | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. -known_false_positives: Admin activities or installing related updates may do a sudden stop to - list of services we monitor. +known_false_positives: Admin activities or installing related updates may do a sudden + stop to list of services we monitor. references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,6 +44,3 @@ tags: - dest - Type security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index b91f27648b..8ea1b6d64b 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -25,6 +25,9 @@ references: tags: analytic_story: - Data Exfiltration + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -40,6 +43,3 @@ tags: - ComputerName - User security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index ef7c2a7603..2305d630fb 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -27,6 +27,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,6 +49,3 @@ tags: - process_id - user_id security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 89173358c8..a66be16155 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -9,7 +9,8 @@ datamodel: description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. + industry or the ransomware note filename is not in your ransomware lookup table + list for monitoring. search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index acf29e9078..cd7f3d85dc 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -28,6 +28,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -47,6 +50,3 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 025747e416..f0add73d4c 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -28,6 +28,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,6 +47,3 @@ tags: - Registry.registry_path - Registry.registry_key_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 1a91a7be88..6fa39d9a41 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -28,6 +28,9 @@ references: tags: analytic_story: - Credential Dumping + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,6 +49,3 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 698fdcdbda..39115e4d85 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -26,6 +26,9 @@ tags: analytic_story: - Ransomware - Revil Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,6 +49,3 @@ tags: - Hashes - IMPHASH security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index bb00fe78a1..07864642a9 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.22.0" + "version": "3.23.0" }, "author": [ { diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index d88c102155..a21d4b85bc 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -316,8 +316,8 @@ modification_date = 2021-02-16 id = bcfd17e8-5461-400a-80a2-3b7d1459220c version = 1 reference = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] -detection_searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1036.003", "T1055", "T1127", "T1127.001", "T1218.010", "T1218.011", "T1548", "T1560.001"], "nist": ["DE.CM", "PR.PT"]} +detection_searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - CMD Echo Pipe - Escalation - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1036.003", "T1055", "T1059.003", "T1127", "T1127.001", "T1218.010", "T1218.011", "T1543.003", "T1548", "T1560.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -361,8 +361,8 @@ modification_date = 2020-02-03 id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version = 1 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] -detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] -mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1114.001", "T1114.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} +detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] +mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1036", "T1114.001", "T1114.002", "T1560.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] @@ -433,7 +433,7 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] @@ -452,8 +452,8 @@ modification_date = 2020-01-22 id = 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] -detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] -mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] +mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Execution", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint", "Network_Traffic"] @@ -515,8 +515,8 @@ modification_date = 2021-05-12 id = 507edc74-13d5-4339-878e-b9114ded1f35 version = 1 reference = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] -detection_searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation", "Obfuscation"], "mitre_attack": ["T1003.001", "T1003.002", "T1020", "T1021.002", "T1055", "T1105", "T1197", "T1218.003", "T1486", "T1490", "T1548.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} +detection_searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Execution", "Exfiltration", "Exploitation", "Lateral Movement", "Obfuscation"], "mitre_attack": ["T1003.001", "T1003.002", "T1020", "T1021.002", "T1055", "T1105", "T1197", "T1218.003", "T1486", "T1490", "T1548.002", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -532,8 +532,8 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] -mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives"], "mitre_attack": ["T1041", "T1114", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]} +detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] +mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation"], "mitre_attack": ["T1041", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] @@ -706,8 +706,8 @@ modification_date = 2021-03-03 id = beae2ab0-7c3f-11eb-8b63-acde48001122 version = 1 reference = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] -detection_searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.003", "T1021.002", "T1059.001", "T1114.002", "T1136.001", "T1190", "T1505.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Execution", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1003.001", "T1003.003", "T1021.002", "T1059.001", "T1114.002", "T1136.001", "T1190", "T1505.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] @@ -861,8 +861,8 @@ modification_date = 2020-02-04 id = 399d65dc-1f08-499b-a259-aad9051f38ad version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] -detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1053.005", "T1550.002", "T1558.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Execution", "Exploitation", "Lateral Movement"], "mitre_attack": ["T1021.001", "T1021.002", "T1053.005", "T1550.002", "T1558.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] @@ -920,6 +920,25 @@ The following content is here to assist with binaries within `system32` or `sysw There will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Meterpreter] +category = Adversary Tactics +creation_date = 2021-06-08 +modification_date = 2021-06-08 +id = d5f8e298-c85a-11eb-9fea-acde48001122 +version = 1 +reference = ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"] +detection_searches = ["ESCU - Excessive number of taskhost processes - Rule"] +mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +investigative_searches = [] +support_searches = [] +data_models = [] +providing_technologies = none +description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels.\ +Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new detections targeted to these detections.\ +While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised and a remote actor used it to progress on their objectives. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Monitor Backup Solution] category = Best Practices creation_date = 2017-09-12 @@ -1097,11 +1116,11 @@ modification_date = 2017-09-11 id = 6d13121c-90f3-446d-8ac3-27efbbc65218 version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] -detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] -mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} +detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] +mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation"], "mitre_attack": ["T1021", "T1021.001", "T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] -data_models = ["Network_Resolution", "Network_Traffic"] +data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -1114,8 +1133,8 @@ modification_date = 2020-02-04 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756 version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] -detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1218.003", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] +mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1482", "T1485", "T1490", "T1491", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Traffic"] @@ -1141,6 +1160,23 @@ description = Leverage searches that allow you to detect and investigate unusual narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Revil Ransomware] +category = Malware +creation_date = 2021-06-04 +modification_date = 2021-06-04 +id = 817cae42-f54b-457a-8a36-fbf45521e29e +version = 1 +reference = ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"] +detection_searches = ["ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"] +mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1204", "T1218.003", "T1490", "T1491"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more. +narrative = Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Router and Infrastructure Security] category = Best Practices creation_date = 2017-09-12 @@ -1201,8 +1237,8 @@ modification_date = 2018-12-13 id = c4b89506-fbcf-4cb7-bfd6-527e54789604 version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] -detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} +detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] +mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic", "Web"] diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 0f6ea9ae55..7b4d4f1655 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -220,7 +220,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - CMD Echo Pipe - Escalation - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -253,7 +253,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -301,7 +301,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -314,7 +314,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -359,7 +359,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload. @@ -370,7 +370,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -484,7 +484,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] +searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -591,7 +591,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -632,6 +632,19 @@ narrative = Security monitoring and control mechanisms may be in place for syste The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ There will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection. +[analytic_story://Meterpreter] +category = Adversary Tactics +last_updated = 2021-06-08 +version = 1 +references = ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"] +maintainers = [{"company": "no", "email": "-", "name": "Michael Hart"}] +spec_version = 3 +searches = ["ESCU - Excessive number of taskhost processes - Rule"] +description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels.\ +Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new detections targeted to these detections.\ +While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised and a remote actor used it to progress on their objectives. + [analytic_story://Monitor Backup Solution] category = Best Practices last_updated = 2017-09-12 @@ -761,7 +774,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -772,7 +785,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -787,6 +800,17 @@ searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without M description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. +[analytic_story://Revil Ransomware] +category = Malware +last_updated = 2021-06-04 +version = 1 +references = ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] +spec_version = 3 +searches = ["ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more. +narrative = Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. + [analytic_story://Router and Infrastructure Security] category = Best Practices last_updated = 2017-09-12 @@ -829,7 +853,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -1682,6 +1706,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.00 known_false_positives = admin or power user may used this series of command. providing_technologies = [] +[savedsearch://ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. +providing_technologies = [] + +[savedsearch://ESCU - Allow Inbound Traffic In Firewall Rule - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +known_false_positives = administrator may allow inbound traffic in certain network or machine. +providing_technologies = [] + [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] type = detection asset_type = Amazon EKS Kubernetes cluster Pod @@ -1802,6 +1846,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - CMD Echo Pipe - Escalation - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +known_false_positives = Unknown. It is possible filtering may be required to ensure fidelity. +providing_technologies = [] + [savedsearch://ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] type = detection asset_type = @@ -2043,6 +2097,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. providing_technologies = [] +[savedsearch://ESCU - Conti Common Exec parameter - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. +providing_technologies = [] + [savedsearch://ESCU - Create Remote Thread into LSASS - Rule] type = detection asset_type = Windows @@ -2340,6 +2404,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. providing_technologies = [] +[savedsearch://ESCU - Detect AzureHound Command-Line Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = Unknown. +providing_technologies = [] + +[savedsearch://ESCU - Detect AzureHound File Modifications - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. +how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Baron Samedit CVE-2021-3156 - Rule] type = detection asset_type = Endpoint @@ -2759,6 +2843,26 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Limited false positives related to third party software registering .DLL's. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed 7-Zip - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +known_false_positives = Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. +providing_technologies = [] + +[savedsearch://ESCU - Detect Renamed PSExec - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +known_false_positives = Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Renamed RClone - Rule] type = detection asset_type = @@ -2769,6 +2873,16 @@ annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed WinRAR - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Modify query for specific EDR products as needed. +annotations = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +known_false_positives = Unknown. It is possible third party applications use renamed instances of WinRAR. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -2839,6 +2953,36 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives known_false_positives = Unknown providing_technologies = [] +[savedsearch://ESCU - Detect SharpHound Command-Line Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect SharpHound File Modifications - Rule] +type = detection +asset_type = +confidence = medium +explanation = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect SharpHound Usage - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Software Download To Network Device - Rule] type = detection asset_type = Infrastructure @@ -3377,6 +3521,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers. providing_technologies = [] +[savedsearch://ESCU - Enable RDP In Other Port Number - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Enumerate Users Local Group Using Telegram - Rule] type = detection asset_type = @@ -3487,6 +3641,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Excessive number of taskhost processes - Rule] +type = detection +asset_type = +confidence = medium +explanation = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +how_to_implement = To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Executables Or Script Creation In Suspicious Path - Rule] type = detection asset_type = @@ -3761,6 +3925,16 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Older systems that support kerberos RC4 by default NetApp may generate false positives providing_technologies = [] +[savedsearch://ESCU - Known Services Killed by Ransomware - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +known_false_positives = Admin activities or installing related updates may do a sudden stop to list of services we monitor. +providing_technologies = [] + [savedsearch://ESCU - Kubernetes AWS detect RBAC authorization by account - Rule] type = detection asset_type = AWS EKS Kubernetes cluster @@ -3971,6 +4145,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Comman known_false_positives = At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list. providing_technologies = [] +[savedsearch://ESCU - Mailsniper Invoke functions - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule] type = detection asset_type = Endpoint @@ -4031,6 +4215,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": [" known_false_positives = Creating a hidden powershell service is rare and could key off of those instances. providing_technologies = [] +[savedsearch://ESCU - Modification Of Wallpaper - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} +known_false_positives = 3rd party tool may used to changed the wallpaper of the machine +providing_technologies = [] + [savedsearch://ESCU - Modify ACL permission To Files Or Folder - Rule] type = detection asset_type = @@ -4661,7 +4855,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +explanation = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} known_false_positives = unknown @@ -4787,6 +4981,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = network admin can resize the shadowstorage for valid purposes. providing_technologies = [] +[savedsearch://ESCU - Revil Common Exec Parameter - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +known_false_positives = third party tool may have same command line parameters as revil ransomware. +providing_technologies = [] + +[savedsearch://ESCU - Revil Registry Entry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - RunDLL Loading DLL By Ordinal - Rule] type = detection asset_type = Endpoint @@ -4990,6 +5204,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] +[savedsearch://ESCU - SecretDumps Offline NTDS Dumping Tool - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Services Escalate Exe - Rule] type = detection asset_type = @@ -5608,6 +5832,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events. providing_technologies = [] +[savedsearch://ESCU - Wbemprox COM Object Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +known_false_positives = legitimate process that are not in the exception list may trigger this event. +providing_technologies = [] + [savedsearch://ESCU - Web Fraud - Account Harvesting - Rule] type = detection asset_type = Account diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index fcee69e414..7be8609537 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 29832 +build = 30583 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.22.0 +version = 3.23.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 109107da69..9b04724183 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 664837cbc0..80a526948d 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.22.0 +version = 3.23.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 380da86438..9f9e31de50 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -335,6 +335,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] +[panel_group://workbench_panel_group_meterpreter] +label = Meterpreter +description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_monitor_backup_solution] label = Monitor Backup Solution description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. @@ -412,6 +419,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] +[panel_group://workbench_panel_group_revil_ransomware] +label = Revil Ransomware +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_router_and_infrastructure_security] label = Router and Infrastructure Security description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index dc8a3656f9..23ff0d0431 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:25 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -427,6 +427,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[allow_inbound_traffic_by_firewall_rule_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_inbound_traffic_in_firewall_rule_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [amazon_eks_kubernetes_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -475,6 +483,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[cmd_echo_pipe___escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [cmlua_or_cmstplua_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -567,6 +579,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[conti_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [create_remote_thread_into_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -675,6 +691,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_azurehound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_azurehound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_baron_samedit_cve_2021_3156_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -839,10 +863,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_renamed_7_zip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_psexec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_renamed_rclone_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_renamed_winrar_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_rogue_dhcp_server_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -871,6 +907,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_sharphound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_software_download_to_network_device_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1079,6 +1127,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[enable_rdp_in_other_port_number_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [enumerate_users_local_group_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1123,6 +1175,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[excessive_number_of_taskhost_processes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [executables_or_script_creation_in_suspicious_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1231,6 +1287,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[known_services_killed_by_ransomware_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [kubernetes_aws_detect_rbac_authorization_by_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1315,6 +1375,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[mailsniper_invoke_functions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [malicious_powershell_process___connect_to_internet_with_hidden_window_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1339,6 +1403,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[modification_of_wallpaper_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [modify_acl_permission_to_files_or_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1631,6 +1699,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[revil_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[revil_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [rundll_loading_dll_by_ordinal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1711,6 +1787,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[secretdumps_offline_ntds_dumping_tool_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [services_escalate_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1951,6 +2031,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wbemprox_com_object_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [web_fraud___account_harvesting_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 953af6c110..84184b0dc9 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -46,6 +46,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -87,6 +88,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -128,6 +130,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -169,6 +172,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -208,6 +212,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -247,6 +252,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -286,6 +292,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -325,6 +332,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -364,6 +372,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -403,6 +412,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -442,6 +452,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -481,6 +492,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -520,6 +532,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -559,6 +572,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -598,6 +612,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -637,6 +652,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -676,6 +692,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -715,6 +732,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -754,6 +772,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -793,6 +812,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -832,6 +852,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -871,6 +892,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -910,6 +932,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -954,6 +977,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -999,6 +1023,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1038,6 +1063,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1078,6 +1104,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1117,6 +1144,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1156,6 +1184,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1195,6 +1224,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1234,6 +1264,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1259,15 +1290,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = Detect memory dumping of the LSASS process. +action.notable.param.rule_title = Access LSASS Memory for Dump Creation +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1308,6 +1346,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1315,6 +1354,87 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter` +[ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +action.escu.known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. +action.escu.creation_date = 2021-05-26 +action.escu.modification_date = 2021-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.notable.param.rule_title = Allow Inbound Traffic By Firewall Rule Registry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter` + +[ESCU - Allow Inbound Traffic In Firewall Rule - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = administrator may allow inbound traffic in certain network or machine. +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Allow Inbound Traffic In Firewall Rule - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Allow Inbound Traffic In Firewall Rule - Rule +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.notable.param.rule_title = Allow Inbound Traffic In Firewall Rule +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter` + [ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1347,6 +1467,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1386,6 +1507,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1426,6 +1548,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1466,6 +1589,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1506,6 +1630,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1546,6 +1671,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1586,6 +1712,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1611,15 +1738,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. +action.notable.param.rule_title = Attempted Credential Dump From Registry via Reg exe +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1660,6 +1794,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1700,6 +1835,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1740,6 +1876,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1780,6 +1917,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1787,6 +1925,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex field=file_name "(?\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat | `batch_file_write_to_system32_filter` +[ESCU - CMD Echo Pipe - Escalation - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Unknown. It is possible filtering may be required to ensure fidelity. +action.escu.creation_date = 2021-05-20 +action.escu.modification_date = 2021-05-20 +action.escu.confidence = high +action.escu.full_search_name = ESCU - CMD Echo Pipe - Escalation - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cobalt Strike"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +action.notable.param.rule_title = CMD Echo Pipe - Escalation +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter` + [ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1819,6 +1998,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1859,6 +2039,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1899,6 +2080,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1939,6 +2121,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1979,6 +2162,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2019,6 +2203,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2061,6 +2246,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2101,6 +2287,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2140,6 +2327,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2179,6 +2367,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2218,6 +2407,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2257,6 +2447,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2296,6 +2487,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2335,6 +2527,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2374,6 +2567,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2414,6 +2608,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2454,6 +2649,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2494,6 +2690,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2534,6 +2731,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2574,6 +2772,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2617,6 +2816,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2661,6 +2861,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2701,6 +2902,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2708,6 +2910,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` | `common_ransomware_notes_filter` +[ESCU - Conti Common Exec parameter - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. +action.escu.creation_date = 2021-06-02 +action.escu.modification_date = 2021-06-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Conti Common Exec parameter - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Conti Common Exec parameter - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. +action.notable.param.rule_title = Conti Common Exec parameter +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter` + [ESCU - Create Remote Thread into LSASS - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2726,15 +2969,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = Detect remote thread creation into LSASS consistent with credential dumping. +action.notable.param.rule_title = Create Remote Thread into LSASS +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2775,6 +3025,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2815,6 +3066,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2855,6 +3107,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2880,15 +3133,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. +action.notable.param.rule_title = Creation of Shadow Copy +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2914,15 +3174,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search detects the use of wmic and Powershell to create a shadow copy. +action.notable.param.rule_title = Creation of Shadow Copy with wmic and powershell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2948,15 +3215,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.notable.param.rule_title = Creation of lsass Dump with Taskmgr +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2982,15 +3256,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search detects credential dumping using copy command from a shadow copy. +action.notable.param.rule_title = Credential Dumping via Copy Command from Shadow Copy +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3016,15 +3297,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search detects the creation of a symlink to a shadow copy. +action.notable.param.rule_title = Credential Dumping via Symlink to Shadow Copy +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3065,6 +3353,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3105,6 +3394,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3151,6 +3441,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3190,6 +3481,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3230,6 +3522,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3274,6 +3567,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3329,6 +3623,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3352,13 +3647,13 @@ action.escu.full_search_name = ESCU - Delete ShadowCopy With PowerShell - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DarkSide Ransomware"] +action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. @@ -3368,6 +3663,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3408,6 +3704,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3448,6 +3745,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3499,6 +3797,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3539,6 +3838,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3590,6 +3890,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3629,6 +3930,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3668,6 +3970,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3707,6 +4010,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3746,6 +4050,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3786,6 +4091,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3793,6 +4099,88 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter` +[ESCU - Detect AzureHound Command-Line Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Unknown. +action.escu.creation_date = 2021-06-01 +action.escu.modification_date = 2021-06-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect AzureHound Command-Line Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Discovery Techniques"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.notable.param.rule_title = Detect AzureHound Command-Line Arguments +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter` + +[ESCU - Detect AzureHound File Modifications - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +action.escu.known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +action.escu.creation_date = 2021-06-01 +action.escu.modification_date = 2021-06-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect AzureHound File Modifications - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Discovery Techniques"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - Rule +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. +action.notable.param.rule_title = Detect AzureHound File Modifications +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter` + [ESCU - Detect Baron Samedit CVE-2021-3156 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3825,6 +4213,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3864,6 +4253,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3903,6 +4293,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3943,6 +4334,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -3968,15 +4360,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search looks for reading lsass memory consistent with credential dumping. +action.notable.param.rule_title = Detect Credential Dumping through LSASS access +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4021,6 +4420,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4065,6 +4465,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4105,6 +4506,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4145,6 +4547,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4184,6 +4587,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4223,6 +4627,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4263,6 +4668,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4303,6 +4709,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4343,6 +4750,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4383,6 +4791,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4422,6 +4831,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4461,6 +4871,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4501,6 +4912,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4541,6 +4953,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4566,15 +4979,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. +action.notable.param.rule_title = Detect Mimikatz Using Loaded Images +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4614,6 +5034,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4654,6 +5075,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4694,6 +5116,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4734,6 +5157,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4773,6 +5197,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4812,6 +5237,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4851,6 +5277,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4891,6 +5318,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4931,6 +5359,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -4970,6 +5399,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5010,6 +5440,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5033,13 +5464,13 @@ action.escu.full_search_name = ESCU - Detect PsExec With accepteula Flag - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware"] +action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5050,6 +5481,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5090,6 +5522,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5130,6 +5563,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5170,6 +5604,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5210,6 +5645,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5250,6 +5686,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5290,6 +5727,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5330,6 +5768,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5370,6 +5809,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5413,6 +5853,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5420,6 +5861,88 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter` +[ESCU - Detect Renamed 7-Zip - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Renamed 7-Zip - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Collection and Staging"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Renamed 7-Zip - Rule +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. +action.notable.param.rule_title = Detect Renamed 7-Zip +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter` + +[ESCU - Detect Renamed PSExec - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Renamed PSExec - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Renamed PSExec - Rule +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. +action.notable.param.rule_title = Detect Renamed PSExec +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter` + [ESCU - Detect Renamed RClone - Rule] action.escu = 0 action.escu.enabled = 1 @@ -5453,6 +5976,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5460,6 +5984,47 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter` +[ESCU - Detect Renamed WinRAR - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Modify query for specific EDR products as needed. +action.escu.known_false_positives = Unknown. It is possible third party applications use renamed instances of WinRAR. +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Renamed WinRAR - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Collection and Staging"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. +action.notable.param.rule_title = Detect Renamed WinRAR +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter` + [ESCU - Detect Rogue DHCP Server - Rule] action.escu = 0 action.escu.enabled = 1 @@ -5493,6 +6058,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5533,6 +6099,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5573,6 +6140,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5613,6 +6181,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5653,6 +6222,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5697,6 +6267,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5736,6 +6307,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5743,6 +6315,129 @@ realtime_schedule = 0 is_visible = false search = `zeek_ssl` | rex field=server_name "(?(LIST|LS|SIZE|LD|CB|CD|EX|ALIVE|EXIT|WHERE|finito)-[A-Za-z0-9]{16}\.)" | stats count by src_ip dest_ip server_name snicat | where count>0 | table src_ip dest_ip server_name snicat | `detect_snicat_sni_exfiltration_filter` +[ESCU - Detect SharpHound Command-Line Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. +action.escu.creation_date = 2021-06-01 +action.escu.modification_date = 2021-06-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect SharpHound Command-Line Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +action.notable.param.rule_title = Detect SharpHound Command-Line Arguments +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter` + +[ESCU - Detect SharpHound File Modifications - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +action.escu.known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +action.escu.creation_date = 2021-05-27 +action.escu.modification_date = 2021-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect SharpHound File Modifications - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - Rule +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +action.notable.param.rule_title = Detect SharpHound File Modifications +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter` + +[ESCU - Detect SharpHound Usage - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. +action.escu.creation_date = 2021-05-27 +action.escu.modification_date = 2021-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect SharpHound Usage - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. +action.notable.param.rule_title = Detect SharpHound Usage +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter` + [ESCU - Detect Software Download To Network Device - Rule] action.escu = 0 action.escu.enabled = 1 @@ -5776,6 +6471,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5827,6 +6523,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5866,6 +6563,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5906,6 +6604,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5951,6 +6650,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -5996,6 +6696,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6041,6 +6742,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6085,6 +6787,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6124,6 +6827,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6164,6 +6868,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6203,6 +6908,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6243,6 +6949,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6282,6 +6989,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6321,6 +7029,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6360,6 +7069,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6400,6 +7110,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6445,6 +7156,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6485,6 +7197,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6525,6 +7238,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6565,6 +7279,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6610,6 +7325,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6650,6 +7366,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6690,6 +7407,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6732,6 +7450,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6772,6 +7491,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6812,6 +7532,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6852,6 +7573,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6892,6 +7614,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6932,6 +7655,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -6972,6 +7696,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7012,6 +7737,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7052,6 +7778,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7092,6 +7819,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7132,6 +7860,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7172,6 +7901,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7212,6 +7942,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7252,6 +7983,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7292,6 +8024,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7332,6 +8065,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7372,6 +8106,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7411,6 +8146,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7436,15 +8172,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = Detect the usage of comsvcs.dll for dumping the lsass process. +action.notable.param.rule_title = Dump LSASS via comsvcs DLL +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7472,15 +8215,23 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.notable.param.rule_title = Dump LSASS via procdump +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7508,15 +8259,23 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump Rename - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.notable.param.rule_title = Dump LSASS via procdump Rename +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7562,6 +8321,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7606,6 +8366,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7645,6 +8406,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7685,6 +8447,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7725,6 +8488,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7766,6 +8530,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7806,6 +8571,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7845,6 +8611,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7852,6 +8619,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` sum(All_Traffic.bytes_out) as bytes_out from datamodel=Network_Traffic where All_Traffic.src_category=email_server by All_Traffic.dest_ip _time span=1d | `drop_dm_object_name("All_Traffic")` | eventstats avg(bytes_out) as avg_bytes_out stdev(bytes_out) as stdev_bytes_out | eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_avg_bytes_out stdev(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_stdev_bytes_out by dest_ip | eval minimum_data_samples = 4, deviation_threshold = 3 | where num_data_samples >= minimum_data_samples AND bytes_out > (avg_bytes_out + (deviation_threshold * stdev_bytes_out)) AND bytes_out > (per_source_avg_bytes_out + (deviation_threshold * per_source_stdev_bytes_out)) AND _time >= relative_time(now(), "@d") | eval num_standard_deviations_away_from_server_average = round(abs(bytes_out - avg_bytes_out) / stdev_bytes_out, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_out - per_source_avg_bytes_out) / per_source_stdev_bytes_out, 2) | table dest_ip, _time, bytes_out, avg_bytes_out, per_source_avg_bytes_out, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average | `email_servers_sending_high_volume_traffic_to_hosts_filter` +[ESCU - Enable RDP In Other Port Number - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Enable RDP In Other Port Number - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Enable RDP In Other Port Number - Rule +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +action.notable.param.rule_title = Enable RDP In Other Port Number +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter` + [ESCU - Enumerate Users Local Group Using Telegram - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7884,6 +8692,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7924,6 +8733,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -7964,6 +8774,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8004,6 +8815,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8044,6 +8856,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8083,6 +8896,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8123,6 +8937,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8163,6 +8978,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8203,6 +9019,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8243,6 +9060,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8255,7 +9073,7 @@ action.escu = 0 action.escu.enabled = 1 description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} -action.escu.data_models = ["Endpoint"] +action.escu.data_models = [] action.escu.eli5 = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. action.escu.known_false_positives = unknown @@ -8275,7 +9093,6 @@ action.correlationsearch.label = ESCU - Excessive Usage of NSLOOKUP App - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.notable.param.rule_title = Excessive Usage of NSLOOKUP App action.notable.param.security_domain = endpoint @@ -8283,12 +9100,54 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter` +search = `sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` + +[ESCU - Excessive number of taskhost processes - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +action.escu.data_models = [] +action.escu.eli5 = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. +action.escu.creation_date = 2021-06-07 +action.escu.modification_date = 2021-06-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Excessive number of taskhost processes - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Meterpreter"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Excessive number of taskhost processes - Rule +action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +action.notable.param.rule_title = Excessive number of taskhost processes +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" BY Processes.dest Processes.process_name _time span=1h | `drop_dm_object_name(Processes)` | eval pid_count=mvcount(process_ids) | eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count > 10 and taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter` [ESCU - Executables Or Script Creation In Suspicious Path - Rule] action.escu = 0 @@ -8323,6 +9182,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8363,6 +9223,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8403,6 +9264,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8443,6 +9305,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8468,15 +9331,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Extract SAM from Registry - Rule action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. +action.notable.param.rule_title = Extract SAM from Registry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8517,6 +9387,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8557,6 +9428,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8597,6 +9469,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8636,6 +9509,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8688,6 +9562,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8727,6 +9602,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8767,6 +9643,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8806,6 +9683,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8846,6 +9724,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8885,6 +9764,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8924,6 +9804,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -8964,6 +9845,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9004,6 +9886,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9044,6 +9927,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9084,6 +9968,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9124,6 +10009,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9163,6 +10049,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9202,6 +10089,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9242,6 +10130,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9282,6 +10171,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9321,6 +10211,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9360,6 +10251,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9367,6 +10259,47 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter` +[ESCU - Known Services Killed by Ransomware - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +action.escu.known_false_positives = Admin activities or installing related updates may do a sudden stop to list of services we monitor. +action.escu.creation_date = 2021-06-04 +action.escu.modification_date = 2021-06-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Known Services Killed by Ransomware - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Known Services Killed by Ransomware - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +action.notable.param.rule_title = Known Services Killed by Ransomware +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter` + [ESCU - Kubernetes AWS detect RBAC authorization by account - Rule] action.escu = 0 action.escu.enabled = 1 @@ -9399,6 +10332,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9438,6 +10372,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9477,6 +10412,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9516,6 +10452,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9556,6 +10493,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9595,6 +10533,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9634,6 +10573,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9673,6 +10613,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9712,6 +10653,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9751,6 +10693,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9790,6 +10733,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9829,6 +10773,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9868,6 +10813,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9908,6 +10854,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9948,6 +10895,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -9988,6 +10936,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10028,6 +10977,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10068,6 +11018,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10108,6 +11059,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10147,6 +11099,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10187,6 +11140,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10194,6 +11148,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos___re_opened_applications_filter` +[ESCU - Mailsniper Invoke functions - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-05-19 +action.escu.modification_date = 2021-05-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Mailsniper Invoke functions - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Data Exfiltration"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule +action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +action.notable.param.rule_title = Mailsniper Invoke functions +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter` + [ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10227,6 +11221,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10267,6 +11262,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10307,6 +11303,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10347,6 +11344,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10387,6 +11385,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10427,6 +11426,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10434,6 +11434,46 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" | regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter` +[ESCU - Modification Of Wallpaper - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = 3rd party tool may used to changed the wallpaper of the machine +action.escu.creation_date = 2021-06-02 +action.escu.modification_date = 2021-06-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Modification Of Wallpaper - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +action.notable.param.rule_title = Modification Of Wallpaper +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter` + [ESCU - Modify ACL permission To Files Or Folder - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10467,6 +11507,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10506,6 +11547,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10545,6 +11587,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10585,6 +11628,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10625,6 +11669,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10664,6 +11709,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10712,6 +11758,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10760,6 +11807,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10808,6 +11856,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10847,6 +11896,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10895,6 +11945,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10943,6 +11994,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -10991,6 +12043,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11039,6 +12092,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11087,6 +12141,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11127,6 +12182,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11167,6 +12223,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11207,6 +12264,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11247,6 +12305,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11276,15 +12335,24 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ +ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ +This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. +action.notable.param.rule_title = Ntdsutil Export NTDS +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11324,6 +12392,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11363,6 +12432,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11402,6 +12472,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11441,6 +12512,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11480,6 +12552,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11519,6 +12592,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11558,6 +12632,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11597,6 +12672,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11636,6 +12712,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11675,6 +12752,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11714,6 +12792,7 @@ schedule_window = auto alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11754,6 +12833,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11793,6 +12873,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11832,6 +12913,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11871,6 +12953,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11911,6 +12994,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11951,6 +13035,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -11991,6 +13076,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12031,6 +13117,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12071,6 +13158,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12110,6 +13198,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12149,6 +13238,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12189,6 +13279,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12228,6 +13319,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12267,6 +13359,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12307,6 +13400,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12346,6 +13440,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12386,6 +13481,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12425,6 +13521,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12465,6 +13562,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12505,6 +13603,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12545,6 +13644,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12585,6 +13685,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12624,6 +13725,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12664,6 +13766,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12704,6 +13807,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12743,6 +13847,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12783,6 +13888,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12822,6 +13928,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12862,6 +13969,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12872,10 +13980,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Ransomware Notes bulk creation - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. action.escu.mappings = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} action.escu.data_models = [] -action.escu.eli5 = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +action.escu.eli5 = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. action.escu.known_false_positives = unknown action.escu.creation_date = 2021-03-12 @@ -12894,13 +14002,14 @@ action.correlationsearch.label = ESCU - Ransomware Notes bulk creation - Rule action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +action.notable.param.rule_description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. action.notable.param.rule_title = Ransomware Notes bulk creation action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12941,6 +14050,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -12981,6 +14091,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13021,6 +14132,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13061,6 +14173,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13101,6 +14214,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13141,6 +14255,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13181,6 +14296,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13221,6 +14337,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13261,6 +14378,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13301,6 +14419,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13341,6 +14460,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13381,6 +14501,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13388,6 +14509,88 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell.exe" OR Processes.parent_process_name = "powershell_ise.exe" OR Processes.parent_process_name = "wmic.exe" Processes.process_name = "vssadmin.exe" Processes.process="*resize*" Processes.process="*shadowstorage*" Processes.process="*/maxsize*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter` +[ESCU - Revil Common Exec Parameter - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = third party tool may have same command line parameters as revil ransomware. +action.escu.creation_date = 2021-06-02 +action.escu.modification_date = 2021-06-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Revil Common Exec Parameter - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Revil Common Exec Parameter - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. +action.notable.param.rule_title = Revil Common Exec Parameter +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter` + +[ESCU - Revil Registry Entry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +action.escu.how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-06-02 +action.escu.modification_date = 2021-06-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Revil Registry Entry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Revil Registry Entry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +action.notable.param.rule_title = Revil Registry Entry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter` + [ESCU - RunDLL Loading DLL By Ordinal - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13421,6 +14624,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13461,6 +14665,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13500,6 +14705,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13540,6 +14746,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13580,6 +14787,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13620,6 +14828,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13660,6 +14869,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13703,6 +14913,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13743,6 +14954,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13783,6 +14995,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13823,6 +15036,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13862,6 +15076,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13901,6 +15116,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13941,6 +15157,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -13981,6 +15198,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14021,6 +15239,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14061,6 +15280,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14101,6 +15321,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14141,6 +15362,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14181,6 +15403,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14188,6 +15411,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter` +[ESCU - SecretDumps Offline NTDS Dumping Tool - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-05-26 +action.escu.modification_date = 2021-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +action.notable.param.rule_title = SecretDumps Offline NTDS Dumping Tool +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `secretdumps_offline_ntds_dumping_tool_filter` + [ESCU - Services Escalate Exe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14221,6 +15485,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14246,15 +15511,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. +action.notable.param.rule_title = Set Default PowerShell Execution Policy To Unrestricted or Bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14295,6 +15567,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14335,6 +15608,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14375,6 +15649,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14414,6 +15689,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14454,6 +15730,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14494,6 +15771,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14534,6 +15812,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14574,6 +15853,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14614,6 +15894,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14654,6 +15935,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14694,6 +15976,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14734,6 +16017,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14773,6 +16057,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14813,6 +16098,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14854,6 +16140,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14894,6 +16181,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14934,6 +16222,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -14974,6 +16263,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15014,6 +16304,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15054,6 +16345,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15115,6 +16407,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15175,6 +16468,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15215,6 +16509,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15255,6 +16550,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15295,6 +16591,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15335,6 +16632,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15375,6 +16673,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15415,6 +16714,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15455,6 +16755,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15495,6 +16796,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15535,6 +16837,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15575,6 +16878,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15615,6 +16919,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15655,6 +16960,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15695,6 +17001,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15735,6 +17042,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15775,6 +17083,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15815,6 +17124,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15854,6 +17164,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15894,6 +17205,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15934,6 +17246,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -15980,6 +17293,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16019,6 +17333,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16058,6 +17373,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16098,6 +17414,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16138,6 +17455,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16178,6 +17496,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16218,6 +17537,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16243,15 +17563,22 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unsigned Image Loaded by LSASS - Rule action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search detects loading of unsigned images by LSASS. Deprecated because too noisy. +action.notable.param.rule_title = Unsigned Image Loaded by LSASS +action.notable.param.security_domain = endpoint +action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16291,6 +17618,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16331,6 +17659,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16371,6 +17700,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16410,6 +17740,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16450,6 +17781,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16490,6 +17822,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16530,6 +17863,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16570,6 +17904,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16609,6 +17944,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16616,6 +17952,46 @@ realtime_schedule = 0 is_visible = false search = `wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" | search query!="SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'" AND query!="SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, query | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmi_temporary_event_subscription_filter` +[ESCU - Wbemprox COM Object Execution - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.escu.data_models = [] +action.escu.eli5 = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = legitimate process that are not in the exception list may trigger this event. +action.escu.creation_date = 2021-06-02 +action.escu.modification_date = 2021-06-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wbemprox COM Object Execution - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +action.notable.param.rule_title = Wbemprox COM Object Execution +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter` + [ESCU - Web Fraud - Account Harvesting - Rule] action.escu = 0 action.escu.enabled = 1 @@ -16649,6 +18025,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16688,6 +18065,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16728,6 +18106,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16768,6 +18147,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16807,6 +18187,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16847,6 +18228,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16887,6 +18269,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16938,6 +18321,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -16989,6 +18373,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17029,6 +18414,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17069,6 +18455,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17109,6 +18496,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17149,6 +18537,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17188,6 +18577,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17228,6 +18618,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17268,6 +18659,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17308,6 +18700,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17348,6 +18741,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17388,6 +18782,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17428,6 +18823,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17467,6 +18863,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17506,6 +18903,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17545,6 +18943,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17584,6 +18983,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17623,6 +19023,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17662,6 +19063,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -17701,6 +19103,7 @@ action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 6fc03b09d3..561eca82d2 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -210,6 +210,7 @@ filename = ransomware_extensions.csv default_match = false case_sensitive_match = false # description = A list of file extensions that are associated with ransomware +match_type = WILDCARD(Extensions) min_matches = 1 [ransomware_notes_lookup] diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 0f6ea9ae55..7b4d4f1655 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:38:43 UTC +# On Date: 2021-06-10T18:24:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -220,7 +220,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - CMD Echo Pipe - Escalation - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -253,7 +253,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -301,7 +301,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -314,7 +314,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -359,7 +359,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload. @@ -370,7 +370,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -484,7 +484,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] +searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -591,7 +591,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -632,6 +632,19 @@ narrative = Security monitoring and control mechanisms may be in place for syste The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ There will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection. +[analytic_story://Meterpreter] +category = Adversary Tactics +last_updated = 2021-06-08 +version = 1 +references = ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"] +maintainers = [{"company": "no", "email": "-", "name": "Michael Hart"}] +spec_version = 3 +searches = ["ESCU - Excessive number of taskhost processes - Rule"] +description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels.\ +Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new detections targeted to these detections.\ +While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised and a remote actor used it to progress on their objectives. + [analytic_story://Monitor Backup Solution] category = Best Practices last_updated = 2017-09-12 @@ -761,7 +774,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -772,7 +785,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -787,6 +800,17 @@ searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without M description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. +[analytic_story://Revil Ransomware] +category = Malware +last_updated = 2021-06-04 +version = 1 +references = ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] +spec_version = 3 +searches = ["ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more. +narrative = Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. + [analytic_story://Router and Infrastructure Security] category = Best Practices last_updated = 2017-09-12 @@ -829,7 +853,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -1682,6 +1706,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.00 known_false_positives = admin or power user may used this series of command. providing_technologies = [] +[savedsearch://ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. +providing_technologies = [] + +[savedsearch://ESCU - Allow Inbound Traffic In Firewall Rule - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +known_false_positives = administrator may allow inbound traffic in certain network or machine. +providing_technologies = [] + [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] type = detection asset_type = Amazon EKS Kubernetes cluster Pod @@ -1802,6 +1846,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - CMD Echo Pipe - Escalation - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +known_false_positives = Unknown. It is possible filtering may be required to ensure fidelity. +providing_technologies = [] + [savedsearch://ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] type = detection asset_type = @@ -2043,6 +2097,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. providing_technologies = [] +[savedsearch://ESCU - Conti Common Exec parameter - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. +providing_technologies = [] + [savedsearch://ESCU - Create Remote Thread into LSASS - Rule] type = detection asset_type = Windows @@ -2340,6 +2404,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. providing_technologies = [] +[savedsearch://ESCU - Detect AzureHound Command-Line Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = Unknown. +providing_technologies = [] + +[savedsearch://ESCU - Detect AzureHound File Modifications - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. +how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Baron Samedit CVE-2021-3156 - Rule] type = detection asset_type = Endpoint @@ -2759,6 +2843,26 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Limited false positives related to third party software registering .DLL's. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed 7-Zip - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +known_false_positives = Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. +providing_technologies = [] + +[savedsearch://ESCU - Detect Renamed PSExec - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +known_false_positives = Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Renamed RClone - Rule] type = detection asset_type = @@ -2769,6 +2873,16 @@ annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed WinRAR - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Modify query for specific EDR products as needed. +annotations = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +known_false_positives = Unknown. It is possible third party applications use renamed instances of WinRAR. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -2839,6 +2953,36 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives known_false_positives = Unknown providing_technologies = [] +[savedsearch://ESCU - Detect SharpHound Command-Line Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect SharpHound File Modifications - Rule] +type = detection +asset_type = +confidence = medium +explanation = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect SharpHound Usage - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +known_false_positives = False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Software Download To Network Device - Rule] type = detection asset_type = Infrastructure @@ -3377,6 +3521,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers. providing_technologies = [] +[savedsearch://ESCU - Enable RDP In Other Port Number - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Enumerate Users Local Group Using Telegram - Rule] type = detection asset_type = @@ -3487,6 +3641,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Excessive number of taskhost processes - Rule] +type = detection +asset_type = +confidence = medium +explanation = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +how_to_implement = To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +known_false_positives = Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Executables Or Script Creation In Suspicious Path - Rule] type = detection asset_type = @@ -3761,6 +3925,16 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Older systems that support kerberos RC4 by default NetApp may generate false positives providing_technologies = [] +[savedsearch://ESCU - Known Services Killed by Ransomware - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +known_false_positives = Admin activities or installing related updates may do a sudden stop to list of services we monitor. +providing_technologies = [] + [savedsearch://ESCU - Kubernetes AWS detect RBAC authorization by account - Rule] type = detection asset_type = AWS EKS Kubernetes cluster @@ -3971,6 +4145,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Comman known_false_positives = At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list. providing_technologies = [] +[savedsearch://ESCU - Mailsniper Invoke functions - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule] type = detection asset_type = Endpoint @@ -4031,6 +4215,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": [" known_false_positives = Creating a hidden powershell service is rare and could key off of those instances. providing_technologies = [] +[savedsearch://ESCU - Modification Of Wallpaper - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} +known_false_positives = 3rd party tool may used to changed the wallpaper of the machine +providing_technologies = [] + [savedsearch://ESCU - Modify ACL permission To Files Or Folder - Rule] type = detection asset_type = @@ -4661,7 +4855,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +explanation = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} known_false_positives = unknown @@ -4787,6 +4981,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = network admin can resize the shadowstorage for valid purposes. providing_technologies = [] +[savedsearch://ESCU - Revil Common Exec Parameter - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +known_false_positives = third party tool may have same command line parameters as revil ransomware. +providing_technologies = [] + +[savedsearch://ESCU - Revil Registry Entry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - RunDLL Loading DLL By Ordinal - Rule] type = detection asset_type = Endpoint @@ -4990,6 +5204,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] +[savedsearch://ESCU - SecretDumps Offline NTDS Dumping Tool - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Services Escalate Exe - Rule] type = detection asset_type = @@ -5608,6 +5832,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events. providing_technologies = [] +[savedsearch://ESCU - Wbemprox COM Object Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +known_false_positives = legitimate process that are not in the exception list may trigger this event. +providing_technologies = [] + [savedsearch://ESCU - Web Fraud - Account Harvesting - Rule] type = detection asset_type = Account diff --git a/dist/escu/lookups/ransomware_extensions.csv b/dist/escu/lookups/ransomware_extensions.csv index 9e8fe7eff6..c50ec5dc9b 100644 --- a/dist/escu/lookups/ransomware_extensions.csv +++ b/dist/escu/lookups/ransomware_extensions.csv @@ -287,4 +287,12 @@ Extensions,Name .WNCRYT,WannaCry .RYK,Ryuk .Clop,Clop -.Cllp,Clop \ No newline at end of file +.Cllp,Clop +.JSWORM,JSWorm +.NEMTY_*,Nemty +.NEFILIM,Nefilim +.OFFWHITE,Offwhite +.TELEGRAM,Telegram +.FUSION,Fusion +.MILIHPEN,Milihpen +.GANGBANG,Gangbang \ No newline at end of file diff --git a/dist/escu/lookups/ransomware_notes.csv b/dist/escu/lookups/ransomware_notes.csv index ecdfd2479d..04bf840433 100644 --- a/dist/escu/lookups/ransomware_notes.csv +++ b/dist/escu/lookups/ransomware_notes.csv @@ -58,4 +58,12 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-READ-FOR-HELLPP.html,True RyukReadMe.html,True ClopReadMe.txt,True -README_README.txt,True \ No newline at end of file +README_README.txt,True +JSWORM-DECRYPT.html,True +NEMTY_*-DECRYPT.txt,True +NEFILIM-DECRYPT.txt,True +OFFWHITE-MANUAL.txt,True +TELEGRAM-RECOVER.txt,True +FUSION-README.txt,True +MILIHPEN-INSTRUCT.txt,True +GANGBANG-NOTE.txt,True \ No newline at end of file diff --git a/dist/saaws/README.md b/dist/saaws/README.md index d0a87c3f9b..6e6649ad7f 100644 --- a/dist/saaws/README.md +++ b/dist/saaws/README.md @@ -1,7 +1,7 @@ -# Splunk ES Content Update +# Splunk Security Analytics for AWS Content Update -This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats. +This subscription service delivers pre-packaged Security Content for use with Splunk Security Analytics for AWS Content. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats. Requires Splunk Enterprise Security version 4.5 or greater. -For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC). \ No newline at end of file +For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC). diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest index 651e6ff0bf..88798c4113 100644 --- a/dist/saaws/app.manifest +++ b/dist/saaws/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS_AmazonWebServices_Content", - "version": "3.22.0" + "version": "3.23.0" }, "author": [ { diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index d634e4d090..87da377997 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index b5a03b603b..42086a2e5b 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 8fd4b0ed24..96528ffe88 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 29832 +build = 30583 [triggers] reload.analytic_stories = simple @@ -18,7 +18,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.22.0 +version = 3.23.0 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content [ui] diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 74e615d716..a158d45299 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf index 664837cbc0..80a526948d 100644 --- a/dist/saaws/default/content-version.conf +++ b/dist/saaws/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.22.0 +version = 3.23.0 diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index da77e39cca..b625f2de7f 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 9ae39851db..080a42b71d 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -38,8 +38,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -78,8 +78,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -118,8 +118,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -158,8 +158,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Aut schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -198,8 +198,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -238,8 +238,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -278,8 +278,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring" schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -318,8 +318,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Use schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -358,8 +358,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -398,8 +398,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -438,8 +438,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -478,8 +478,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -518,8 +518,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Acti schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -558,8 +558,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Acti schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -598,8 +598,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Cred schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -638,8 +638,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Cred schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -678,8 +678,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -718,8 +718,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Es schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -758,8 +758,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Use schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -798,8 +798,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Ins schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -838,8 +838,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -878,8 +878,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Use schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -918,8 +918,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Use schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -958,8 +958,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"] schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -998,8 +998,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"] schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1038,8 +1038,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"] schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1078,8 +1078,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"] schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1118,8 +1118,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Ins schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1159,8 +1159,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Pro schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1200,8 +1200,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Pro schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1241,8 +1241,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Pro schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1282,8 +1282,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Pro schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1322,8 +1322,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Aut schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1362,8 +1362,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1402,8 +1402,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1442,8 +1442,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1482,8 +1482,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Ac schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1522,8 +1522,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Ac schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1562,8 +1562,8 @@ action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Ale schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1602,8 +1602,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1642,8 +1642,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1682,8 +1682,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1722,8 +1722,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1762,8 +1762,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1802,8 +1802,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1842,8 +1842,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1882,8 +1882,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1922,8 +1922,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -1962,8 +1962,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 @@ -2002,8 +2002,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detection schedule_window = auto alert.digest_mode = 1 disabled = false -allow_skew = 100% enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index d145e46965..e5c6e4b651 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -210,6 +210,7 @@ filename = ransomware_extensions.csv default_match = false case_sensitive_match = false # description = A list of file extensions that are associated with ransomware +match_type = WILDCARD(Extensions) min_matches = 1 [ransomware_notes_lookup] diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index b5a03b603b..42086a2e5b 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-05-24T20:39:00 UTC +# On Date: 2021-06-10T18:24:49 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/lookups/ransomware_extensions.csv b/dist/saaws/lookups/ransomware_extensions.csv index 9e8fe7eff6..c50ec5dc9b 100644 --- a/dist/saaws/lookups/ransomware_extensions.csv +++ b/dist/saaws/lookups/ransomware_extensions.csv @@ -287,4 +287,12 @@ Extensions,Name .WNCRYT,WannaCry .RYK,Ryuk .Clop,Clop -.Cllp,Clop \ No newline at end of file +.Cllp,Clop +.JSWORM,JSWorm +.NEMTY_*,Nemty +.NEFILIM,Nefilim +.OFFWHITE,Offwhite +.TELEGRAM,Telegram +.FUSION,Fusion +.MILIHPEN,Milihpen +.GANGBANG,Gangbang \ No newline at end of file diff --git a/dist/saaws/lookups/ransomware_notes.csv b/dist/saaws/lookups/ransomware_notes.csv index ecdfd2479d..04bf840433 100644 --- a/dist/saaws/lookups/ransomware_notes.csv +++ b/dist/saaws/lookups/ransomware_notes.csv @@ -58,4 +58,12 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-READ-FOR-HELLPP.html,True RyukReadMe.html,True ClopReadMe.txt,True -README_README.txt,True \ No newline at end of file +README_README.txt,True +JSWORM-DECRYPT.html,True +NEMTY_*-DECRYPT.txt,True +NEFILIM-DECRYPT.txt,True +OFFWHITE-MANUAL.txt,True +TELEGRAM-RECOVER.txt,True +FUSION-README.txt,True +MILIHPEN-INSTRUCT.txt,True +GANGBANG-NOTE.txt,True \ No newline at end of file diff --git a/docs/detections.md b/docs/detections.md index ffecbf436e..257e47fe05 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -119,6 +119,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + - [Amazon EKS Kubernetes Pod scan detection](#amazon-eks-kubernetes-pod-scan-detection) @@ -170,6 +174,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -282,6 +288,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -320,6 +328,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -406,6 +418,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -423,6 +441,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + - [Detect Spike in AWS Security Hub Alerts for EC2 Instance](#detect-spike-in-aws-security-hub-alerts-for-ec2-instance) @@ -572,6 +596,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -640,6 +668,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -720,6 +750,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -1102,6 +1136,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -1210,6 +1252,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Allow Inbound Traffic By Firewall Rule Registry](#allow-inbound-traffic-by-firewall-rule-registry) + + + +- [Allow Inbound Traffic In Firewall Rule](#allow-inbound-traffic-in-firewall-rule) + + + @@ -1270,6 +1320,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [CMD Echo Pipe - Escalation](#cmd-echo-pipe---escalation) + + + - [CMLUA Or CMSTPLUA UAC Bypass](#cmlua-or-cmstplua-uac-bypass) @@ -1338,6 +1392,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Conti Common Exec parameter](#conti-common-exec-parameter) + + + - [Create Remote Thread into LSASS](#create-remote-thread-into-lsass) @@ -1434,6 +1492,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Delete ShadowCopy With PowerShell](#delete-shadowcopy-with-powershell) + - [Deleting Of Net Users](#deleting-of-net-users) @@ -1462,6 +1522,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Detect AzureHound Command-Line Arguments](#detect-azurehound-command-line-arguments) + + + +- [Detect AzureHound File Modifications](#detect-azurehound-file-modifications) + + + - [Detect Baron Samedit CVE-2021-3156](#detect-baron-samedit-cve-2021-3156) @@ -1616,10 +1684,22 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Detect Renamed 7-Zip](#detect-renamed-7-zip) + + + +- [Detect Renamed PSExec](#detect-renamed-psexec) + + + - [Detect Renamed RClone](#detect-renamed-rclone) +- [Detect Renamed WinRAR](#detect-renamed-winrar) + + + - [Detect Rundll32 Application Control Bypass - advpack](#detect-rundll32-application-control-bypass---advpack) @@ -1642,6 +1722,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Detect SharpHound Command-Line Arguments](#detect-sharphound-command-line-arguments) + + + +- [Detect SharpHound File Modifications](#detect-sharphound-file-modifications) + + + +- [Detect SharpHound Usage](#detect-sharphound-usage) + + + @@ -1792,6 +1884,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Enable RDP In Other Port Number](#enable-rdp-in-other-port-number) + + + - [Enumerate Users Local Group Using Telegram](#enumerate-users-local-group-using-telegram) @@ -1834,6 +1930,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Excessive number of taskhost processes](#excessive-number-of-taskhost-processes) + + + - [Executables Or Script Creation In Suspicious Path](#executables-or-script-creation-in-suspicious-path) @@ -1962,6 +2062,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Known Services Killed by Ransomware](#known-services-killed-by-ransomware) + + + @@ -2006,6 +2110,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Mailsniper Invoke functions](#mailsniper-invoke-functions) + + + - [Malicious PowerShell Process - Connect To Internet With Hidden Window](#malicious-powershell-process---connect-to-internet-with-hidden-window) @@ -2028,6 +2136,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Modification Of Wallpaper](#modification-of-wallpaper) + + + - [Modify ACL permission To Files Or Folder](#modify-acl-permission-to-files-or-folder) @@ -2324,6 +2436,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Revil Common Exec Parameter](#revil-common-exec-parameter) + + + +- [Revil Registry Entry](#revil-registry-entry) + + + - [RunDLL Loading DLL By Ordinal](#rundll-loading-dll-by-ordinal) @@ -2396,6 +2516,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [SecretDumps Offline NTDS Dumping Tool](#secretdumps-offline-ntds-dumping-tool) + + + - [Services Escalate Exe](#services-escalate-exe) @@ -2628,6 +2752,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Wbemprox COM Object Execution](#wbemprox-com-object-execution) + + + @@ -2896,6 +3024,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -2970,6 +3106,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3036,6 +3176,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -3061,6 +3207,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + - [Detect Software Download To Network Device](#detect-software-download-to-network-device) @@ -3186,6 +3338,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3246,6 +3400,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3316,6 +3472,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3344,6 +3502,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3542,6 +3704,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3672,6 +3838,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3763,6 +3931,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4027,6 +4197,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + @@ -4185,6 +4367,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + @@ -4355,6 +4549,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + @@ -4631,6 +4835,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -4737,6 +4947,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5022,6 +5234,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + @@ -5140,6 +5364,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + @@ -5380,6 +5616,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + @@ -5580,6 +5826,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -5634,6 +5884,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5793,6 +6045,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -8312,6 +8566,162 @@ admin or power user may used this series of command. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +_version_: 1 + + +--- + +### Allow Inbound Traffic By Firewall Rule Registry +This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021/001/) +- **Last Updated**: 2021-05-26 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "* +|Action=Allow +|*" Registry.registry_value_name = "* +|Dir=In +|*" Registry.registry_value_name = "* +|Profile=Public +|*" Registry.registry_value_name = "* +|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `allow_inbound_traffic_by_firewall_rule_registry_filter` +``` +#### Associated Analytic Story + +* Prohibited Traffic Allowed or Protocol Mismatch + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_path + +* Registry.registry_value_name + +* Registry.registry_key_name + +* Registry.dest + +* Registry.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1021.001 | Remote Desktop Protocol | Lateral Movement | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. + +#### Reference + + +* https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Allow Inbound Traffic In Firewall Rule +This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021/001/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` +`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_inbound_traffic_in_firewall_rule_filter` +``` +#### Associated Analytic Story + +* Prohibited Traffic Allowed or Protocol Mismatch + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +#### Required field + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1021.001 | Remote Desktop Protocol | Lateral Movement | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +administrator may allow inbound traffic in certain network or machine. + +#### Reference + + +* https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + + _version_: 1
@@ -9597,6 +10007,91 @@ It is possible for this search to generate a notable event for a batch file writ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log +_version_: 1 + + +--- + +### CMD Echo Pipe - Escalation +This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1059.003](https://attack.mitre.org/techniques/T1059/003/), [T1543.003](https://attack.mitre.org/techniques/T1543/003/) +- **Last Updated**: 2021-05-20 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `cmd_echo_pipe___escalation_filter` +``` +#### Associated Analytic Story + +* Cobalt Strike + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1059.003 | Windows Command Shell | Execution | +| T1543.003 | Windows Service | Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + +* Privilege Escalation + + +#### Known False Positives +Unknown. It is possible filtering may be required to ensure fidelity. + +#### Reference + + +* https://redcanary.com/threat-detection-report/threats/cobalt-strike/ + +* https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + + _version_: 1
@@ -11382,6 +11877,86 @@ _version_: 4 --- +### Conti Common Exec parameter +This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1204](https://attack.mitre.org/techniques/T1204/) +- **Last Updated**: 2021-06-02 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `conti_common_exec_parameter_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1204 | User Execution | Execution | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +3rd party tool may have commandline parameter that can trigger this detection. + +#### Reference + + +* https://malpedia.caad.fkie.fraunhofer.de/details/win.conti + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Create Remote Thread into LSASS Detect remote thread creation into LSASS consistent with credential dumping. @@ -13448,6 +14023,10 @@ This following analytic detects PowerShell command to delete shadow copy using t * DarkSide Ransomware +* Ransomware + +* Revil Ransomware + #### How To Implement To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -13492,6 +14071,8 @@ unknown #### Test Dataset +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + _version_: 1 @@ -14266,6 +14847,178 @@ _version_: 5 --- +### Detect AzureHound Command-Line Arguments +The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/), [T1087.001](https://attack.mitre.org/techniques/T1087/001/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1069.002](https://attack.mitre.org/techniques/T1069/002/), [T1069.001](https://attack.mitre.org/techniques/T1069/001/) +- **Last Updated**: 2021-06-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_azurehound_command_line_arguments_filter` +``` +#### Associated Analytic Story + +* Discovery Techniques + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | +| T1087.001 | Local Account | Discovery | +| T1482 | Domain Trust Discovery | Discovery | +| T1069.002 | Domain Groups | Discovery | +| T1069.001 | Local Groups | Discovery | + + +#### Kill Chain Phase + +* Reconnaissance + + +#### Known False Positives +Unknown. + +#### Reference + + +* https://attack.mitre.org/software/S0521/ + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 + +* https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Detect AzureHound File Modifications +The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/), [T1087.001](https://attack.mitre.org/techniques/T1087/001/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1069.002](https://attack.mitre.org/techniques/T1069/002/), [T1069.001](https://attack.mitre.org/techniques/T1069/001/) +- **Last Updated**: 2021-06-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_azurehound_file_modifications_filter` +``` +#### Associated Analytic Story + +* Discovery Techniques + + +#### How To Implement +To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +#### Required field + +* _time + +* file_path + +* dest + +* file_name + +* process_id + +* file_create_time + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | +| T1087.001 | Local Account | Discovery | +| T1482 | Domain Trust Discovery | Discovery | +| T1069.002 | Domain Groups | Discovery | +| T1069.001 | Local Groups | Discovery | + + +#### Kill Chain Phase + +* Reconnaissance + + +#### Known False Positives +False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. + +#### Reference + + +* https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 + +* https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Detect Baron Samedit CVE-2021-3156 This search detects the heap-based buffer overflow of sudoedit @@ -17064,6 +17817,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla * DarkSide Ransomware +* Lateral Movement + #### How To Implement You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -17881,6 +18636,184 @@ Limited false positives related to third party software registering .DLL's. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Detect Renamed 7-Zip +The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1560.001](https://attack.mitre.org/techniques/T1560/001/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` +`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_7_zip_filter` +``` +#### Associated Analytic Story + +* Collection and Staging + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1560.001 | Archive via Utility | Collection | + + +#### Kill Chain Phase + +* Exfiltration + + +#### Known False Positives +Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. + +#### Reference + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Detect Renamed PSExec +The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1569.002](https://attack.mitre.org/techniques/T1569/002/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` +`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_psexec_filter` +``` +#### Associated Analytic Story + +* SamSam Ransomware + +* DHS Report TA18-074A + +* HAFNIUM Group + +* DarkSide Ransomware + +* Lateral Movement + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +#### Required field + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1569.002 | Service Execution | Execution | + + +#### Kill Chain Phase + +* Exploitation + +* Lateral Movement + +* Execution + + +#### Known False Positives +Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. + +#### Reference + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml + +* https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -17963,6 +18896,90 @@ False positives should be limited as this analytic identifies renamed instances * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log +_version_: 1 + + +--- + +### Detect Renamed WinRAR +The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1560.001](https://attack.mitre.org/techniques/T1560/001/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` +`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_winrar_filter` +``` +#### Associated Analytic Story + +* Collection and Staging + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Modify query for specific EDR products as needed. + +#### Required field + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1560.001 | Archive via Utility | Collection | + + +#### Kill Chain Phase + +* Exploitation + +* Exfiltration + + +#### Known False Positives +Unknown. It is possible third party applications use renamed instances of WinRAR. + +#### Reference + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + + _version_: 1
@@ -18526,6 +19543,286 @@ Unknown #### Test Dataset +_version_: 1 + + +--- + +### Detect SharpHound Command-Line Arguments +The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/), [T1087.001](https://attack.mitre.org/techniques/T1087/001/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1069.002](https://attack.mitre.org/techniques/T1069/002/), [T1069.001](https://attack.mitre.org/techniques/T1069/001/) +- **Last Updated**: 2021-06-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_command_line_arguments_filter` +``` +#### Associated Analytic Story + +* Discovery Techniques + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | +| T1087.001 | Local Account | Discovery | +| T1482 | Domain Trust Discovery | Discovery | +| T1069.002 | Domain Groups | Discovery | +| T1069.001 | Local Groups | Discovery | + + +#### Kill Chain Phase + +* Reconnaissance + + +#### Known False Positives +False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. + +#### Reference + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Detect SharpHound File Modifications +SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/), [T1087.001](https://attack.mitre.org/techniques/T1087/001/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1069.002](https://attack.mitre.org/techniques/T1069/002/), [T1069.001](https://attack.mitre.org/techniques/T1069/001/) +- **Last Updated**: 2021-05-27 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_file_modifications_filter` +``` +#### Associated Analytic Story + +* Discovery Techniques + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +#### Required field + +* _time + +* file_path + +* dest + +* file_name + +* process_id + +* file_create_time + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | +| T1087.001 | Local Account | Discovery | +| T1482 | Domain Trust Discovery | Discovery | +| T1069.002 | Domain Groups | Discovery | +| T1069.001 | Local Groups | Discovery | + + +#### Kill Chain Phase + +* Reconnaissance + + +#### Known False Positives +False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. + +#### Reference + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Detect SharpHound Usage +The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/), [T1087.001](https://attack.mitre.org/techniques/T1087/001/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1069.002](https://attack.mitre.org/techniques/T1069/002/), [T1069.001](https://attack.mitre.org/techniques/T1069/001/) +- **Last Updated**: 2021-05-27 + +
+ details + +#### Search +``` +`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_usage_filter` +``` +#### Associated Analytic Story + +* Discovery Techniques + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | +| T1087.001 | Local Account | Discovery | +| T1482 | Domain Trust Discovery | Discovery | +| T1069.002 | Domain Groups | Discovery | +| T1069.001 | Local Groups | Discovery | + + +#### Kill Chain Phase + +* Reconnaissance + + +#### Known False Positives +False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. + +#### Reference + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + _version_: 1
@@ -22460,6 +23757,80 @@ _version_: 2 --- +### Enable RDP In Other Port Number +This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1021](https://attack.mitre.org/techniques/T1021/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `enable_rdp_in_other_port_number_filter` +``` +#### Associated Analytic Story + +* Prohibited Traffic Allowed or Protocol Mismatch + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +#### Required field + +* _time + +* Registry.registry_path + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1021 | Remote Services | Lateral Movement | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Enumerate Users Local Group Using Telegram This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. @@ -23270,12 +24641,15 @@ this search is to detect potential DNS exfiltration using nslookup application. #### Search ``` - -| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name -| where count >= 30 -| `drop_dm_object_name(Processes)` +`sysmon` EventCode = 1 process_name = "nslookup.exe" +| bucket _time span=15m +| stats count as numNsLookup by Computer, _time +| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer +| eval upperThreshold=(avgNsLookup + stdNsLookup *3) +| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) +| search isOutlier=1 | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` ``` #### Associated Analytic Story @@ -23339,6 +24713,85 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log +_version_: 1 + + +--- + +### Excessive number of taskhost processes +This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1033](https://attack.mitre.org/techniques/T1033/) +- **Last Updated**: 2021-06-07 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" BY Processes.dest Processes.process_name _time span=1h +| `drop_dm_object_name(Processes)` +| eval pid_count=mvcount(process_ids) +| eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) +| eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) +| stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, firstTime, lastTime +| where taskhost_count > 10 and taskhostex_count > 10 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_number_of_taskhost_processes_filter` +``` +#### Associated Analytic Story + +* Meterpreter + + +#### How To Implement +To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Processes.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1033 | System Owner/User Discovery | Discovery | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. + +#### Reference + + +* https://attack.mitre.org/software/S0250/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log + + _version_: 1
@@ -26206,6 +27659,81 @@ _version_: 3 --- +### Known Services Killed by Ransomware +This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1490](https://attack.mitre.org/techniques/T1490/) +- **Last Updated**: 2021-06-04 + +
+ details + +#### Search +``` +`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `known_services_killed_by_ransomware_filter` +``` +#### Associated Analytic Story + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. + +#### Required field + +* _time + +* EventCode + +* Message + +* dest + +* Type + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1490 | Inhibit System Recovery | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Admin activities or installing related updates may do a sudden stop to list of services we monitor. + +#### Reference + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log + + +_version_: 1 +
+ +--- + ### Kubernetes AWS detect RBAC authorization by account This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences @@ -27353,6 +28881,79 @@ At this stage, there are no known false positives. During testing, no process ev #### Test Dataset +_version_: 1 + + +--- + +### Mailsniper Invoke functions +This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1114.001](https://attack.mitre.org/techniques/T1114/001/) +- **Last Updated**: 2021-05-19 + +
+ details + +#### Search +``` +`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `mailsniper_invoke_functions_filter` +``` +#### Associated Analytic Story + +* Data Exfiltration + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +#### Required field + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1114.001 | Local Email Collection | Collection | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + + _version_: 1
@@ -27820,6 +29421,91 @@ Creating a hidden powershell service is rare and could key off of those instance * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log +_version_: 1 + + +--- + +### Modification Of Wallpaper +This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1491](https://attack.mitre.org/techniques/T1491/) +- **Last Updated**: 2021-06-02 + +
+ details + +#### Search +``` +`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `modification_of_wallpaper_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* EventCode + +* Image + +* TargetObject + +* Details + +* Computer + +* process_guid + +* process_id + +* user_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1491 | Defacement | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +3rd party tool may used to changed the wallpaper of the machine + +#### Reference + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + _version_: 1
@@ -32625,7 +34311,7 @@ _version_: 2 --- ### Ransomware Notes bulk creation -The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -34770,6 +36456,172 @@ network admin can resize the shadowstorage for valid purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log +_version_: 1 + + +--- + +### Revil Common Exec Parameter +This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1204](https://attack.mitre.org/techniques/T1204/) +- **Last Updated**: 2021-06-02 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `revil_common_exec_parameter_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest + +* Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1204 | User Execution | Execution | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +third party tool may have same command line parameters as revil ransomware. + +#### Reference + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Revil Registry Entry +This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/) +- **Last Updated**: 2021-06-02 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `revil_registry_entry_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + +* Registry.registry_path + +* Registry.registry_key_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1112 | Modify Registry | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + _version_: 1
@@ -36328,6 +38180,86 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log +_version_: 1 + + +--- + +### SecretDumps Offline NTDS Dumping Tool +This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1003.003](https://attack.mitre.org/techniques/T1003/003/) +- **Last Updated**: 2021-05-26 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `secretdumps_offline_ntds_dumping_tool_filter` +``` +#### Associated Analytic Story + +* Credential Dumping + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1003.003 | NTDS | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + _version_: 1
@@ -39999,7 +41931,7 @@ None * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log -_version_: 1 +_version_: 2 --- @@ -41320,6 +43252,93 @@ Some software may create WMI temporary event subscriptions for various purposes. #### Test Dataset +_version_: 1 + + +--- + +### Wbemprox COM Object Execution +this search is designed to detect potential malicious process loading COM object to wbemprox.dll, + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1218.003](https://attack.mitre.org/techniques/T1218/003/) +- **Last Updated**: 2021-06-02 + +
+ details + +#### Search +``` +`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) +| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wbemprox_com_object_execution_filter` +``` +#### Associated Analytic Story + +* Ransomware + +* Revil Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Image + +* ImageLoaded + +* process_name + +* Computer + +* EventCode + +* Signed + +* ProcessId + +* Hashes + +* IMPHASH + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1218.003 | CMSTP | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +legitimate process that are not in the exception list may trigger this event. + +#### Reference + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + + _version_: 1
diff --git a/docs/detections.wiki b/docs/detections.wiki index 269e938dfd..e57dfd6d34 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -12371,6 +12371,172 @@ admin or power user may used this series of command. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +''version'': 1 + + + +---- + +===Allow inbound traffic by firewall rule registry=== +This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''Last Updated''': 2021-05-26 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "* +|Action=Allow +|*" Registry.registry_value_name = "* +|Dir=In +|*" Registry.registry_value_name = "* +|Profile=Public +|*" Registry.registry_value_name = "* +|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `allow_inbound_traffic_by_firewall_rule_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_path + +* Registry.registry_value_name + +* Registry.registry_key_name + +* Registry.dest + +* Registry.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1021.001 +| Remote Desktop Protocol +| Lateral Movement +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. + +====Reference==== + + +* https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Allow inbound traffic in firewall rule=== +This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== +`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_inbound_traffic_in_firewall_rule_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +====Required field==== + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1021.001 +| Remote Desktop Protocol +| Lateral Movement +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +administrator may allow inbound traffic in certain network or machine. + +====Reference==== + + +* https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + + ''version'': 1
@@ -13642,6 +13808,99 @@ It is possible for this search to generate a notable event for a batch file writ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log +''version'': 1 + + + +---- + +===Cmd echo pipe - escalation=== +This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/003/ T1059.003], [https://attack.mitre.org/techniques/T1543/003/ T1543.003] +* '''Last Updated''': 2021-05-20 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `cmd_echo_pipe___escalation_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1059.003 +| Windows Command Shell +| Execution +|- +| T1543.003 +| Windows Service +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + +* Privilege Escalation + + +====Known False Positives==== +Unknown. It is possible filtering may be required to ensure fidelity. + +====Reference==== + + +* https://redcanary.com/threat-detection-report/threats/cobalt-strike/ + +* https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + + ''version'': 1
@@ -14578,6 +14837,91 @@ It's possible that a legitimate file could be created with the same name used by ---- +===Conti common exec parameter=== +This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204] +* '''Last Updated''': 2021-06-02 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `conti_common_exec_parameter_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1204 +| User Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +3rd party tool may have commandline parameter that can trigger this detection. + +====Reference==== + + +* https://malpedia.caad.fkie.fraunhofer.de/details/win.conti + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Create remote thread into lsass=== Detect remote thread creation into LSASS consistent with credential dumping. @@ -16416,6 +16760,90 @@ Limited false positives. If there is a true false positive, filter based on comm * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Delete shadowcopy with powershell=== +This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490] +* '''Last Updated''': 2021-05-12 + +
+
+ +====Search==== +`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `delete_shadowcopy_with_powershell_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +====Required field==== + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1490 +| Inhibit System Recovery +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + + ''version'': 1
@@ -16669,6 +17097,212 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea ---- +===Detect azurehound command-line arguments=== +The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''Last Updated''': 2021-06-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_azurehound_command_line_arguments_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Discovery_Techniques|Discovery Techniques]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|- +| T1087.001 +| Local Account +| Discovery +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1069.002 +| Domain Groups +| Discovery +|- +| T1069.001 +| Local Groups +| Discovery +|} + + +====Kill Chain Phase==== + +* Reconnaissance + + +====Known False Positives==== +Unknown. + +====Reference==== + + +* https://attack.mitre.org/software/S0521/ + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 + +* https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Detect azurehound file modifications=== +The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''Last Updated''': 2021-06-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_azurehound_file_modifications_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Discovery_Techniques|Discovery Techniques]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +====Required field==== + +* _time + +* file_path + +* dest + +* file_name + +* process_id + +* file_create_time + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|- +| T1087.001 +| Local Account +| Discovery +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1069.002 +| Domain Groups +| Discovery +|- +| T1069.001 +| Local Groups +| Discovery +|} + + +====Kill Chain Phase==== + +* Reconnaissance + + +====Known False Positives==== +False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. + +====Reference==== + + +* https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 + +* https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Detect baron samedit cve-2021-3156=== This search detects the heap-based buffer overflow of sudoedit @@ -18526,6 +19160,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla * [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + ====How To Implement==== You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -19388,6 +20024,194 @@ Limited false positives related to third party software registering .DLL's. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Detect renamed 7-zip=== +The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== +`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_7_zip_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Collection_and_Staging|Collection and Staging]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1560.001 +| Archive via Utility +| Collection +|} + + +====Kill Chain Phase==== + +* Exfiltration + + +====Known False Positives==== +Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. + +====Reference==== + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Detect renamed psexec=== +The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage. During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== +`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_psexec_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#HAFNIUM_Group|HAFNIUM Group]] + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +====Required field==== + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1569.002 +| Service Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + +* Lateral Movement + +* Execution + + +====Known False Positives==== +Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. + +====Reference==== + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml + +* https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + + ''version'': 1
@@ -19475,6 +20299,95 @@ False positives should be limited as this analytic identifies renamed instances * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log +''version'': 1 + + + +---- + +===Detect renamed winrar=== +The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== +`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_winrar_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Collection_and_Staging|Collection and Staging]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Modify query for specific EDR products as needed. + +====Required field==== + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1560.001 +| Archive via Utility +| Collection +|} + + +====Kill Chain Phase==== + +* Exploitation + +* Exfiltration + + +====Known False Positives==== +Unknown. It is possible third party applications use renamed instances of WinRAR. + +====Reference==== + + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + + ''version'': 1
@@ -19825,6 +20738,337 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Detect sharphound command-line arguments=== +The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''Last Updated''': 2021-06-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_command_line_arguments_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Discovery_Techniques|Discovery Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|- +| T1087.001 +| Local Account +| Discovery +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1069.002 +| Domain Groups +| Discovery +|- +| T1069.001 +| Local Groups +| Discovery +|} + + +====Kill Chain Phase==== + +* Reconnaissance + + +====Known False Positives==== +False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. + +====Reference==== + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Detect sharphound file modifications=== +SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''Last Updated''': 2021-05-27 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_file_modifications_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Discovery_Techniques|Discovery Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + +====Required field==== + +* _time + +* file_path + +* dest + +* file_name + +* process_id + +* file_create_time + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|- +| T1087.001 +| Local Account +| Discovery +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1069.002 +| Domain Groups +| Discovery +|- +| T1069.001 +| Local Groups +| Discovery +|} + + +====Kill Chain Phase==== + +* Reconnaissance + + +====Known False Positives==== +False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. + +====Reference==== + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Detect sharphound usage=== +The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''Last Updated''': 2021-05-27 + +
+
+ +====Search==== +`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_sharphound_usage_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Discovery_Techniques|Discovery Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* dest + +* User + +* parent_process_name + +* process_name + +* OriginalFileName + +* process_path + +* CommandLine + +* Product + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|- +| T1087.001 +| Local Account +| Discovery +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1069.002 +| Domain Groups +| Discovery +|- +| T1069.001 +| Local Groups +| Discovery +|} + + +====Kill Chain Phase==== + +* Reconnaissance + + +====Known False Positives==== +False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. + +====Reference==== + + +* https://attack.mitre.org/software/S0521/ + +* https://thedfirreport.com/?s=bloodhound + +* https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors + +* https://github.com/BloodHoundAD/SharpHound3 + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + + ''version'': 1
@@ -21775,6 +23019,85 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Enable rdp in other port number=== +This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `enable_rdp_in_other_port_number_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +====Required field==== + +* _time + +* Registry.registry_path + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1021 +| Remote Services +| Lateral Movement +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + ''version'': 1
@@ -22562,12 +23885,15 @@ this search is to detect potential DNS exfiltration using nslookup application.
====Search==== - -| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name -| where count >= 30 -| `drop_dm_object_name(Processes)` +`sysmon` EventCode = 1 process_name = "nslookup.exe" +| bucket _time span=15m +| stats count as numNsLookup by Computer, _time +| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer +| eval upperThreshold=(avgNsLookup + stdNsLookup *3) +| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) +| search isOutlier=1 | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` ====Associated Analytic Story==== @@ -22636,6 +23962,90 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log +''version'': 1 +
+ + +---- + +===Excessive number of taskhost processes=== +This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1033/ T1033] +* '''Last Updated''': 2021-06-07 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" BY Processes.dest Processes.process_name _time span=1h +| `drop_dm_object_name(Processes)` +| eval pid_count=mvcount(process_ids) +| eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) +| eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) +| stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, firstTime, lastTime +| where taskhost_count > 10 and taskhostex_count > 10 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_number_of_taskhost_processes_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Meterpreter|Meterpreter]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1033 +| System Owner/User Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. + +====Reference==== + + +* https://attack.mitre.org/software/S0250/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log + + ''version'': 1
@@ -24830,6 +26240,86 @@ Older systems that support kerberos RC4 by default NetApp may generate false pos ---- +===Known services killed by ransomware=== +This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490] +* '''Last Updated''': 2021-06-04 + +
+
+ +====Search==== +`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `known_services_killed_by_ransomware_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. + +====Required field==== + +* _time + +* EventCode + +* Message + +* dest + +* Type + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1490 +| Inhibit System Recovery +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Admin activities or installing related updates may do a sudden stop to list of services we monitor. + +====Reference==== + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log + + +''version'': 1 +
+
+ +---- + ===Macos - re-opened applications=== This search looks for processes referencing the plist files that determine which applications are re-opened when a user reboots their machine. @@ -24890,6 +26380,84 @@ At this stage, there are no known false positives. During testing, no process ev ====Test Dataset==== +''version'': 1 + + + +---- + +===Mailsniper invoke functions=== +This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/001/ T1114.001] +* '''Last Updated''': 2021-05-19 + +
+
+ +====Search==== +`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `mailsniper_invoke_functions_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Data_Exfiltration|Data Exfiltration]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +====Required field==== + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1114.001 +| Local Email Collection +| Collection +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + + ''version'': 1
@@ -25319,6 +26887,96 @@ Creating a hidden powershell service is rare and could key off of those instance * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log +''version'': 1 + + + +---- + +===Modification of wallpaper=== +This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1491/ T1491] +* '''Last Updated''': 2021-06-02 + +
+
+ +====Search==== +`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `modification_of_wallpaper_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* EventCode + +* Image + +* TargetObject + +* Details + +* Computer + +* process_guid + +* process_id + +* user_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1491 +| Defacement +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +3rd party tool may used to changed the wallpaper of the machine + +====Reference==== + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + ''version'': 1
@@ -28175,7 +29833,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, ---- ===Ransomware notes bulk creation=== -The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. +The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -30140,6 +31798,182 @@ network admin can resize the shadowstorage for valid purposes. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log +''version'': 1 + + + +---- + +===Revil common exec parameter=== +This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204] +* '''Last Updated''': 2021-06-02 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `revil_common_exec_parameter_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest + +* Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1204 +| User Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +third party tool may have same command line parameters as revil ransomware. + +====Reference==== + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Revil registry entry=== +This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112] +* '''Last Updated''': 2021-06-02 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `revil_registry_entry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + +* Registry.registry_path + +* Registry.registry_key_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1112 +| Modify Registry +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + + ''version'': 1
@@ -31486,6 +33320,91 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log +''version'': 1 + + + +---- + +===Secretdumps offline ntds dumping tool=== +This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''Last Updated''': 2021-05-26 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `secretdumps_offline_ntds_dumping_tool_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.dest Processes.user + +* Processes.process_id + +* Processes.process_guid + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1003.003 +| NTDS +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + + ''version'': 1
@@ -34808,7 +36727,7 @@ None * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log -''version'': 1 +''version'': 2 @@ -35860,6 +37779,98 @@ Some software may create WMI temporary event subscriptions for various purposes. ====Test Dataset==== +''version'': 1 + + + +---- + +===Wbemprox com object execution=== +this search is designed to detect potential malicious process loading COM object to wbemprox.dll, + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003] +* '''Last Updated''': 2021-06-02 + +
+
+ +====Search==== +`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) +| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wbemprox_com_object_execution_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Revil_Ransomware|Revil Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Image + +* ImageLoaded + +* process_name + +* Computer + +* EventCode + +* Signed + +* ProcessId + +* Hashes + +* IMPHASH + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1218.003 +| CMSTP +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +legitimate process that are not in the exception list may trigger this event. + +====Reference==== + + +* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + +* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + + ''version'': 1
@@ -37158,89 +39169,6 @@ False positives should be limited. -==Experimental== - - -===Delete shadowcopy with powershell=== -This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. - -* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490] -* '''Last Updated''': 2021-05-12 - -
-
- -====Search==== -`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `delete_shadowcopy_with_powershell_filter` - -====Associated Analytic Story==== - -* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] - - -====How To Implement==== -To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. - -====Required field==== - -* _time - -* EventCode - -* Message - -* ComputerName - -* User - - - -====ATT&CK==== -{| -! style="text-align:left;"| ID -! Technique -! Tactic -|- -| T1490 -| Inhibit System Recovery -| Impact -|} - - -====Kill Chain Phase==== - -* Exploitation - - -====Known False Positives==== -unknown - -====Reference==== - - -* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - -* https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security - - - -====Test Dataset==== - - -''version'': 1 -
-
- ----- - - - ==Network== @@ -40135,7 +42063,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-05-24 20:50:06.922125 UTC''
+# On Date: 2021-06-10 18:37:21.829243 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index ddf444a3cd..cd158ff29c 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -8,7 +8,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -20,7 +22,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -47,17 +49,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -78,12 +80,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -100,8 +102,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -135,7 +137,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -151,7 +153,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -164,19 +171,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -307,7 +323,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -320,7 +336,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -347,12 +364,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -362,14 +380,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -469,23 +488,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -555,7 +579,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -614,7 +640,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -842,13 +872,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -918,7 +949,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -933,19 +965,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -981,11 +1015,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -1025,7 +1060,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -1037,7 +1074,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -1064,17 +1101,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -1095,12 +1132,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -1117,8 +1154,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -1152,7 +1189,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -1168,7 +1205,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -1181,19 +1223,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -1324,7 +1375,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -1337,7 +1388,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -1364,12 +1416,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -1379,14 +1432,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -1486,23 +1540,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -1572,7 +1631,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -1631,7 +1692,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -1859,13 +1924,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -1935,7 +2001,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -1950,19 +2017,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -1998,11 +2067,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -2042,7 +2112,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -2054,7 +2126,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -2081,17 +2153,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -2112,12 +2184,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -2134,8 +2206,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -2169,7 +2241,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -2185,7 +2257,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -2198,19 +2275,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -2341,7 +2427,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -2354,7 +2440,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -2381,12 +2468,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -2396,14 +2484,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -2503,23 +2592,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -2589,7 +2683,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -2648,7 +2744,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -2876,13 +2976,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -2952,7 +3053,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -2967,19 +3069,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -3015,11 +3119,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -3059,7 +3164,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -3071,7 +3178,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -3098,17 +3205,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -3129,12 +3236,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -3151,8 +3258,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -3186,7 +3293,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -3202,7 +3309,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -3215,19 +3327,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -3358,7 +3479,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -3371,7 +3492,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -3398,12 +3520,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -3413,14 +3536,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -3520,23 +3644,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -3606,7 +3735,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -3665,7 +3796,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -3893,13 +4028,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -3969,7 +4105,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -3984,19 +4121,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -4032,11 +4171,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -4076,7 +4216,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -4088,7 +4230,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -4115,17 +4257,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -4146,12 +4288,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -4168,8 +4310,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -4203,7 +4345,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -4219,7 +4361,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -4232,19 +4379,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -4375,7 +4531,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -4388,7 +4544,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -4415,12 +4572,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -4430,14 +4588,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -4537,23 +4696,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -4623,7 +4787,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -4682,7 +4848,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -4910,13 +5080,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -4986,7 +5157,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -5001,19 +5173,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -5049,11 +5223,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -5093,7 +5268,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -5105,7 +5282,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -5132,17 +5309,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -5163,12 +5340,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -5185,8 +5362,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -5220,7 +5397,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -5236,7 +5413,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -5249,19 +5431,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -5392,7 +5583,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -5405,7 +5596,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -5432,12 +5624,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -5447,14 +5640,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -5554,23 +5748,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -5640,7 +5839,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -5699,7 +5900,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -5927,13 +6132,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -6003,7 +6209,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -6018,19 +6225,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -6066,11 +6275,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -6110,7 +6320,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -6122,7 +6334,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -6149,17 +6361,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -6180,12 +6392,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -6202,8 +6414,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -6237,7 +6449,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -6253,7 +6465,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -6266,19 +6483,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -6409,7 +6635,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -6422,7 +6648,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -6449,12 +6676,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -6464,14 +6692,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -6571,23 +6800,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -6657,7 +6891,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -6716,7 +6952,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -6944,13 +7184,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -7020,7 +7261,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -7035,19 +7277,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -7083,11 +7327,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -7127,7 +7372,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -7139,7 +7386,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -7166,17 +7413,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -7197,12 +7444,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -7219,8 +7466,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -7254,7 +7501,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -7270,7 +7517,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -7283,19 +7535,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -7426,7 +7687,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -7439,7 +7700,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -7466,12 +7728,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -7481,14 +7744,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -7588,23 +7852,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -7674,7 +7943,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -7733,7 +8004,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -7961,13 +8236,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -8037,7 +8313,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -8052,19 +8329,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -8100,11 +8379,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -8144,7 +8424,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -8156,7 +8438,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -8183,17 +8465,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -8214,12 +8496,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -8236,8 +8518,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -8271,7 +8553,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -8287,7 +8569,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -8300,19 +8587,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -8443,7 +8739,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -8456,7 +8752,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -8483,12 +8780,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -8498,14 +8796,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -8605,23 +8904,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -8691,7 +8995,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -8750,7 +9056,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -8978,13 +9288,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -9054,7 +9365,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -9069,19 +9381,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -9117,11 +9431,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -9161,7 +9476,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -9173,7 +9490,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -9200,17 +9517,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -9231,12 +9548,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -9253,8 +9570,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -9288,7 +9605,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -9304,7 +9621,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -9317,19 +9639,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -9460,7 +9791,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -9473,7 +9804,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -9500,12 +9832,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -9515,14 +9848,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -9622,23 +9956,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -9708,7 +10047,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -9767,7 +10108,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -9995,13 +10340,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -10071,7 +10417,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -10086,19 +10433,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -10134,11 +10483,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -10178,7 +10528,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -10190,7 +10542,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -10217,17 +10569,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -10248,12 +10600,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -10270,8 +10622,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -10305,7 +10657,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -10321,7 +10673,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -10334,19 +10691,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -10477,7 +10843,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -10490,7 +10856,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -10517,12 +10884,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -10532,14 +10900,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -10639,23 +11008,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -10725,7 +11099,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -10784,7 +11160,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -11012,13 +11392,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -11088,7 +11469,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -11103,19 +11485,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -11151,11 +11535,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -11195,7 +11580,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -11207,7 +11594,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -11234,17 +11621,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -11265,12 +11652,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -11287,8 +11674,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -11322,7 +11709,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -11338,7 +11725,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -11351,19 +11743,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -11494,7 +11895,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -11507,7 +11908,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -11534,12 +11936,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -11549,14 +11952,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -11656,23 +12060,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -11742,7 +12151,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -11801,7 +12212,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -12029,13 +12444,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -12105,7 +12521,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -12120,19 +12537,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -12168,11 +12587,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -12212,7 +12632,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -12224,7 +12646,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -12251,17 +12673,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -12282,12 +12704,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -12304,8 +12726,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -12339,7 +12761,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -12355,7 +12777,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -12368,19 +12795,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -12511,7 +12947,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -12524,7 +12960,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -12551,12 +12988,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -12566,14 +13004,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -12673,23 +13112,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -12759,7 +13203,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -12818,7 +13264,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -13046,13 +13496,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -13122,7 +13573,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -13137,19 +13589,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -13185,11 +13639,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -13229,7 +13684,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -13241,7 +13698,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -13268,17 +13725,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -13299,12 +13756,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -13321,8 +13778,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -13356,7 +13813,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -13372,7 +13829,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -13385,19 +13847,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -13528,7 +13999,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -13541,7 +14012,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -13568,12 +14040,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -13583,14 +14056,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -13690,23 +14164,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -13776,7 +14255,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -13835,7 +14316,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -14063,13 +14548,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -14139,7 +14625,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -14154,19 +14641,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -14202,11 +14691,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -14246,7 +14736,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -14258,7 +14750,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -14285,17 +14777,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -14316,12 +14808,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -14338,8 +14830,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -14373,7 +14865,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -14389,7 +14881,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -14402,19 +14899,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -14545,7 +15051,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -14558,7 +15064,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -14585,12 +15092,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -14600,14 +15108,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -14707,23 +15216,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -14793,7 +15307,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -14852,7 +15368,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -15080,13 +15600,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -15156,7 +15677,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -15171,19 +15693,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -15219,11 +15743,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -15263,7 +15788,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -15275,7 +15802,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -15302,17 +15829,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -15333,12 +15860,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -15355,8 +15882,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -15390,7 +15917,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -15406,7 +15933,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -15419,19 +15951,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -15562,7 +16103,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -15575,7 +16116,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -15602,12 +16144,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -15617,14 +16160,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -15724,23 +16268,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -15810,7 +16359,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -15869,7 +16420,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -16097,13 +16652,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -16173,7 +16729,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -16188,19 +16745,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -16236,11 +16795,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -16280,7 +16840,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -16292,7 +16854,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -16319,17 +16881,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -16350,12 +16912,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -16372,8 +16934,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -16407,7 +16969,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -16423,7 +16985,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -16436,19 +17003,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -16579,7 +17155,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -16592,7 +17168,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -16619,12 +17196,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -16634,14 +17212,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -16741,23 +17320,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -16827,7 +17411,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -16886,7 +17472,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -17114,13 +17704,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -17190,7 +17781,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -17205,19 +17797,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -17253,11 +17847,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -17297,7 +17892,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -17309,7 +17906,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -17336,17 +17933,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -17367,12 +17964,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -17389,8 +17986,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -17424,7 +18021,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -17440,7 +18037,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -17453,19 +18055,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -17596,7 +18207,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -17609,7 +18220,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -17636,12 +18248,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -17651,14 +18264,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -17758,23 +18372,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -17844,7 +18463,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -17903,7 +18524,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -18131,13 +18756,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -18207,7 +18833,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -18222,19 +18849,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -18270,11 +18899,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -18314,7 +18944,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -18326,7 +18958,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -18353,17 +18985,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -18384,12 +19016,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -18406,8 +19038,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -18441,7 +19073,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -18457,7 +19089,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -18470,19 +19107,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -18613,7 +19259,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -18626,7 +19272,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -18653,12 +19300,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -18668,14 +19316,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -18775,23 +19424,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -18861,7 +19515,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -18920,7 +19576,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -19148,13 +19808,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -19224,7 +19885,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -19239,19 +19901,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -19287,11 +19951,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -19331,7 +19996,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -19343,7 +20010,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -19370,17 +20037,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -19401,12 +20068,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -19423,8 +20090,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -19458,7 +20125,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -19474,7 +20141,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -19487,19 +20159,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -19630,7 +20311,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -19643,7 +20324,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -19670,12 +20352,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -19685,14 +20368,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -19792,23 +20476,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -19878,7 +20567,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -19937,7 +20628,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -20165,13 +20860,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -20241,7 +20937,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -20256,19 +20953,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -20304,11 +21003,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -20348,7 +21048,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -20360,7 +21062,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -20387,17 +21089,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -20418,12 +21120,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -20440,8 +21142,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -20475,7 +21177,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -20491,7 +21193,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -20504,19 +21211,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -20647,7 +21363,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -20660,7 +21376,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -20687,12 +21404,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -20702,14 +21420,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -20809,23 +21528,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -20895,7 +21619,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -20954,7 +21680,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -21182,13 +21912,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -21258,7 +21989,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -21273,19 +22005,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -21321,11 +22055,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -21365,7 +22100,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -21377,7 +22114,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -21404,17 +22141,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -21435,12 +22172,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -21457,8 +22194,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -21492,7 +22229,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -21508,7 +22245,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -21521,19 +22263,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -21664,7 +22415,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -21677,7 +22428,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -21704,12 +22456,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -21719,14 +22472,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -21826,23 +22580,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -21912,7 +22671,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -21971,7 +22732,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -22199,13 +22964,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -22275,7 +23041,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -22290,19 +23057,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -22338,11 +23107,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -22382,7 +23152,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -22394,7 +23166,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -22421,17 +23193,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -22452,12 +23224,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -22474,8 +23246,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -22509,7 +23281,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -22525,7 +23297,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -22538,19 +23315,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -22681,7 +23467,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -22694,7 +23480,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -22721,12 +23508,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -22736,14 +23524,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -22843,23 +23632,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -22929,7 +23723,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -22988,7 +23784,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -23216,13 +24016,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -23292,7 +24093,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -23307,19 +24109,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -23355,11 +24159,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -23399,7 +24204,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -23411,7 +24218,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -23438,17 +24245,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -23469,12 +24276,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -23491,8 +24298,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -23526,7 +24333,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -23542,7 +24349,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -23555,19 +24367,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -23698,7 +24519,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -23711,7 +24532,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -23738,12 +24560,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -23753,14 +24576,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -23860,23 +24684,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -23946,7 +24775,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -24005,7 +24836,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -24233,13 +25068,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -24309,7 +25145,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -24324,19 +25161,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -24372,11 +25211,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -24416,7 +25256,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -24428,7 +25270,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -24455,17 +25297,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -24486,12 +25328,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -24508,8 +25350,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -24543,7 +25385,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -24559,7 +25401,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -24572,19 +25419,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -24715,7 +25571,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -24728,7 +25584,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -24755,12 +25612,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -24770,14 +25628,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -24877,23 +25736,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -24963,7 +25827,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -25022,7 +25888,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -25250,13 +26120,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -25326,7 +26197,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -25341,19 +26213,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -25389,11 +26263,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -25433,7 +26308,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -25445,7 +26322,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -25472,17 +26349,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -25503,12 +26380,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -25525,8 +26402,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -25560,7 +26437,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -25576,7 +26453,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -25589,19 +26471,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -25732,7 +26623,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -25745,7 +26636,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -25772,12 +26664,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -25787,14 +26680,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -25894,23 +26788,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -25980,7 +26879,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -26039,7 +26940,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -26267,13 +27172,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -26343,7 +27249,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -26358,19 +27265,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -26406,11 +27315,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -26450,7 +27360,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -26462,7 +27374,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -26489,17 +27401,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -26520,12 +27432,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -26542,8 +27454,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -26577,7 +27489,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -26593,7 +27505,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -26606,19 +27523,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -26749,7 +27675,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -26762,7 +27688,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -26789,12 +27716,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -26804,14 +27732,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -26911,23 +27840,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -26997,7 +27931,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -27056,7 +27992,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -27284,13 +28224,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -27360,7 +28301,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -27375,19 +28317,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -27423,11 +28367,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -27467,7 +28412,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -27479,7 +28426,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -27506,17 +28453,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -27537,12 +28484,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -27559,8 +28506,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -27594,7 +28541,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -27610,7 +28557,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -27623,19 +28575,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -27766,7 +28727,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -27779,7 +28740,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -27806,12 +28768,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -27821,14 +28784,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -27928,23 +28892,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -28014,7 +28983,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -28073,7 +29044,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -28301,13 +29276,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -28377,7 +29353,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -28392,19 +29369,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -28440,11 +29419,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -28484,7 +29464,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -28496,7 +29478,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -28523,17 +29505,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -28554,12 +29536,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -28576,8 +29558,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -28611,7 +29593,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -28627,7 +29609,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -28640,19 +29627,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -28783,7 +29779,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -28796,7 +29792,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -28823,12 +29820,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -28838,14 +29836,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -28945,23 +29944,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -29031,7 +30035,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -29090,7 +30096,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -29318,13 +30328,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -29394,7 +30405,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -29409,19 +30421,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -29457,11 +30471,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -29501,7 +30516,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -29513,7 +30530,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -29540,17 +30557,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -29571,12 +30588,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -29593,8 +30610,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -29628,7 +30645,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -29644,7 +30661,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -29657,19 +30679,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -29800,7 +30831,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -29813,7 +30844,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -29840,12 +30872,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -29855,14 +30888,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -29962,23 +30996,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -30048,7 +31087,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -30107,7 +31148,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -30335,13 +31380,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -30411,7 +31457,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -30426,19 +31473,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -30474,11 +31523,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -30518,7 +31568,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -30530,7 +31582,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -30557,17 +31609,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -30588,12 +31640,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -30610,8 +31662,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -30645,7 +31697,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -30661,7 +31713,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -30674,19 +31731,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -30817,7 +31883,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -30830,7 +31896,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -30857,12 +31924,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -30872,14 +31940,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -30979,23 +32048,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -31065,7 +32139,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -31124,7 +32200,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -31352,13 +32432,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -31428,7 +32509,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -31443,19 +32525,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -31491,11 +32575,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -31535,7 +32620,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -31547,7 +32634,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -31574,17 +32661,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -31605,12 +32692,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -31627,8 +32714,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -31662,7 +32749,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -31678,7 +32765,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -31691,19 +32783,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -31834,7 +32935,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -31847,7 +32948,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -31874,12 +32976,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -31889,14 +32992,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -31996,23 +33100,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -32082,7 +33191,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -32141,7 +33252,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -32369,13 +33484,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -32445,7 +33561,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -32460,19 +33577,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -32508,11 +33627,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -32552,7 +33672,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -32564,7 +33686,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -32591,17 +33713,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -32622,12 +33744,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -32644,8 +33766,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -32679,7 +33801,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -32695,7 +33817,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -32708,19 +33835,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -32851,7 +33987,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -32864,7 +34000,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -32891,12 +34028,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -32906,14 +34044,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -33013,23 +34152,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -33099,7 +34243,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -33158,7 +34304,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -33386,13 +34536,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -33462,7 +34613,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -33477,19 +34629,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -33525,11 +34679,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -33569,7 +34724,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -33581,7 +34738,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -33608,17 +34765,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -33639,12 +34796,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -33661,8 +34818,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -33696,7 +34853,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -33712,7 +34869,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -33725,19 +34887,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -33868,7 +35039,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -33881,7 +35052,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -33908,12 +35080,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -33923,14 +35096,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -34030,23 +35204,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -34116,7 +35295,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -34175,7 +35356,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -34403,13 +35588,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -34479,7 +35665,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -34494,19 +35681,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -34542,11 +35731,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -34586,7 +35776,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -34598,7 +35790,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -34625,17 +35817,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -34656,12 +35848,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -34678,8 +35870,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -34713,7 +35905,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -34729,7 +35921,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -34742,19 +35939,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -34885,7 +36091,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -34898,7 +36104,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -34925,12 +36132,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -34940,14 +36148,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -35047,23 +36256,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -35133,7 +36347,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -35192,7 +36408,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -35420,13 +36640,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -35496,7 +36717,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -35511,19 +36733,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -35559,11 +36783,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -35603,7 +36828,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -35615,7 +36842,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -35642,17 +36869,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -35673,12 +36900,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -35695,8 +36922,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -35730,7 +36957,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -35746,7 +36973,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -35759,19 +36991,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -35902,7 +37143,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -35915,7 +37156,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -35942,12 +37184,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -35957,14 +37200,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -36064,23 +37308,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -36150,7 +37399,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -36209,7 +37460,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -36437,13 +37692,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -36513,7 +37769,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -36528,19 +37785,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -36576,11 +37835,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -36620,7 +37880,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -36632,7 +37894,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -36659,17 +37921,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -36690,12 +37952,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -36712,8 +37974,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -36747,7 +38009,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -36763,7 +38025,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -36776,19 +38043,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -36919,7 +38195,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -36932,7 +38208,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -36959,12 +38236,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -36974,14 +38252,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -37081,23 +38360,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -37167,7 +38451,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -37226,7 +38512,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -37454,13 +38744,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -37530,7 +38821,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -37545,19 +38837,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -37593,11 +38887,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -37637,7 +38932,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -37649,7 +38946,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -37676,17 +38973,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -37707,12 +39004,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -37729,8 +39026,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -37764,7 +39061,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -37780,7 +39077,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -37793,19 +39095,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -37936,7 +39247,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -37949,7 +39260,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -37976,12 +39288,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -37991,14 +39304,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -38098,23 +39412,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -38184,7 +39503,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -38243,7 +39564,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -38471,13 +39796,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -38547,7 +39873,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -38562,19 +39889,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -38610,11 +39939,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -38654,7 +39984,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -38666,7 +39998,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -38693,17 +40025,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -38724,12 +40056,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -38746,8 +40078,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -38781,7 +40113,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -38797,7 +40129,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -38810,19 +40147,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -38953,7 +40299,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -38966,7 +40312,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -38993,12 +40340,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -39008,14 +40356,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -39115,23 +40464,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -39201,7 +40555,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -39260,7 +40616,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -39488,13 +40848,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -39564,7 +40925,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -39579,19 +40941,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -39627,11 +40991,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -39671,7 +41036,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -39683,7 +41050,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -39710,17 +41077,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -39741,12 +41108,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -39763,8 +41130,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -39798,7 +41165,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -39814,7 +41181,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -39827,19 +41199,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -39970,7 +41351,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -39983,7 +41364,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -40010,12 +41392,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -40025,14 +41408,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -40132,23 +41516,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -40218,7 +41607,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -40277,7 +41668,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -40505,13 +41900,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -40581,7 +41977,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -40596,19 +41993,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -40644,11 +42043,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -40688,7 +42088,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -40700,7 +42102,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -40727,17 +42129,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -40758,12 +42160,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -40780,8 +42182,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -40815,7 +42217,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -40831,7 +42233,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -40844,19 +42251,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -40987,7 +42403,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -41000,7 +42416,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -41027,12 +42444,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -41042,14 +42460,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -41149,23 +42568,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -41235,7 +42659,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -41294,7 +42720,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -41522,13 +42952,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -41598,7 +43029,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -41613,19 +43045,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -41661,11 +43095,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -41705,7 +43140,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -41717,7 +43154,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -41744,17 +43181,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -41775,12 +43212,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -41797,8 +43234,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -41832,7 +43269,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -41848,7 +43285,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -41861,19 +43303,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -42004,7 +43455,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -42017,7 +43468,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -42044,12 +43496,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -42059,14 +43512,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -42166,23 +43620,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -42252,7 +43711,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -42311,7 +43772,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -42539,13 +44004,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -42615,7 +44081,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -42630,19 +44097,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -42678,11 +44147,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -42722,7 +44192,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -42734,7 +44206,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -42761,17 +44233,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -42792,12 +44264,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -42814,8 +44286,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -42849,7 +44321,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -42865,7 +44337,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -42878,19 +44355,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -43021,7 +44507,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -43034,7 +44520,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -43061,12 +44548,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -43076,14 +44564,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -43183,23 +44672,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -43269,7 +44763,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -43328,7 +44824,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -43556,13 +45056,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -43632,7 +45133,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -43647,19 +45149,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -43695,11 +45199,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -43739,7 +45244,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -43751,7 +45258,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -43778,17 +45285,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -43809,12 +45316,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -43831,8 +45338,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -43866,7 +45373,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -43882,7 +45389,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -43895,19 +45407,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -44038,7 +45559,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -44051,7 +45572,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -44078,12 +45600,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -44093,14 +45616,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -44200,23 +45724,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -44286,7 +45815,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -44345,7 +45876,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -44573,13 +46108,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -44649,7 +46185,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -44664,19 +46201,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -44712,11 +46251,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -44756,7 +46296,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -44768,7 +46310,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -44795,17 +46337,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -44826,12 +46368,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -44848,8 +46390,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -44883,7 +46425,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -44899,7 +46441,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -44912,19 +46459,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -45055,7 +46611,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -45068,7 +46624,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -45095,12 +46652,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -45110,14 +46668,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -45217,23 +46776,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -45303,7 +46867,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -45362,7 +46928,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -45590,13 +47160,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -45666,7 +47237,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -45681,19 +47253,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -45729,11 +47303,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -45773,7 +47348,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -45785,7 +47362,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -45812,17 +47389,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -45843,12 +47420,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -45865,8 +47442,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -45900,7 +47477,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -45916,7 +47493,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -45929,19 +47511,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -46072,7 +47663,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -46085,7 +47676,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -46112,12 +47704,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -46127,14 +47720,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -46234,23 +47828,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -46320,7 +47919,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -46379,7 +47980,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -46607,13 +48212,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -46683,7 +48289,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -46698,19 +48305,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -46746,11 +48355,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -46790,7 +48400,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -46802,7 +48414,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -46829,17 +48441,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -46860,12 +48472,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -46882,8 +48494,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -46917,7 +48529,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -46933,7 +48545,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -46946,19 +48563,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -47089,7 +48715,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -47102,7 +48728,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -47129,12 +48756,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -47144,14 +48772,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -47251,23 +48880,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -47337,7 +48971,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -47396,7 +49032,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -47624,13 +49264,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -47700,7 +49341,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -47715,19 +49357,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -47763,11 +49407,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -47807,7 +49452,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -47819,7 +49466,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -47846,17 +49493,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -47877,12 +49524,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -47899,8 +49546,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -47934,7 +49581,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -47950,7 +49597,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -47963,19 +49615,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -48106,7 +49767,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -48119,7 +49780,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -48146,12 +49808,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -48161,14 +49824,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -48268,23 +49932,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -48354,7 +50023,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -48413,7 +50084,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -48641,13 +50316,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -48717,7 +50393,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -48732,19 +50409,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -48780,11 +50459,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -48824,7 +50504,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -48836,7 +50518,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -48863,17 +50545,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -48894,12 +50576,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -48916,8 +50598,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -48951,7 +50633,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -48967,7 +50649,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -48980,19 +50667,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -49123,7 +50819,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -49136,7 +50832,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -49163,12 +50860,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -49178,14 +50876,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -49285,23 +50984,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -49371,7 +51075,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -49430,7 +51136,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -49658,13 +51368,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -49734,7 +51445,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -49749,19 +51461,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -49797,11 +51511,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -49841,7 +51556,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -49853,7 +51570,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -49880,17 +51597,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -49911,12 +51628,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -49933,8 +51650,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -49968,7 +51685,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -49984,7 +51701,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -49997,19 +51719,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -50140,7 +51871,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -50153,7 +51884,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -50180,12 +51912,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -50195,14 +51928,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -50302,23 +52036,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -50388,7 +52127,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -50447,7 +52188,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -50675,13 +52420,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -50751,7 +52497,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -50766,19 +52513,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -50814,11 +52563,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -50858,7 +52608,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -50870,7 +52622,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -50897,17 +52649,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -50928,12 +52680,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -50950,8 +52702,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -50985,7 +52737,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -51001,7 +52753,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -51014,19 +52771,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -51157,7 +52923,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -51170,7 +52936,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -51197,12 +52964,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -51212,14 +52980,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -51319,23 +53088,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -51405,7 +53179,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -51464,7 +53240,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -51692,13 +53472,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -51768,7 +53549,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -51783,19 +53565,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -51831,11 +53615,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -51875,7 +53660,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -51887,7 +53674,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -51914,17 +53701,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -51945,12 +53732,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -51967,8 +53754,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -52002,7 +53789,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -52018,7 +53805,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -52031,19 +53823,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -52174,7 +53975,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -52187,7 +53988,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -52214,12 +54016,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -52229,14 +54032,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -52336,23 +54140,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -52422,7 +54231,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -52481,7 +54292,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -52709,13 +54524,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -52785,7 +54601,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -52800,19 +54617,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -52848,11 +54667,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -52892,7 +54712,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -52904,7 +54726,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -52931,17 +54753,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -52962,12 +54784,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -52984,8 +54806,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -53019,7 +54841,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -53035,7 +54857,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -53048,19 +54875,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -53191,7 +55027,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -53204,7 +55040,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -53231,12 +55068,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -53246,14 +55084,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -53353,23 +55192,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -53439,7 +55283,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -53498,7 +55344,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -53726,13 +55576,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -53802,7 +55653,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -53817,19 +55669,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -53865,11 +55719,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -53909,7 +55764,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -53921,7 +55778,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -53948,17 +55805,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -53979,12 +55836,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -54001,8 +55858,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -54036,7 +55893,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -54052,7 +55909,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -54065,19 +55927,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -54208,7 +56079,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -54221,7 +56092,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -54248,12 +56120,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -54263,14 +56136,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -54370,23 +56244,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -54456,7 +56335,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -54515,7 +56396,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -54743,13 +56628,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -54819,7 +56705,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -54834,19 +56721,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -54882,11 +56771,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -54926,7 +56816,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -54938,7 +56830,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -54965,17 +56857,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -54996,12 +56888,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -55018,8 +56910,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -55053,7 +56945,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -55069,7 +56961,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -55082,19 +56979,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -55225,7 +57131,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -55238,7 +57144,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -55265,12 +57172,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -55280,14 +57188,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -55387,23 +57296,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -55473,7 +57387,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -55532,7 +57448,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -55760,13 +57680,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -55836,7 +57757,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -55851,19 +57773,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -55899,11 +57823,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -55943,7 +57868,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -55955,7 +57882,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -55982,17 +57909,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -56013,12 +57940,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -56035,8 +57962,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -56070,7 +57997,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -56086,7 +58013,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -56099,19 +58031,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -56242,7 +58183,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -56255,7 +58196,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -56282,12 +58224,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -56297,14 +58240,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -56404,23 +58348,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -56490,7 +58439,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -56549,7 +58500,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -56777,13 +58732,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -56853,7 +58809,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -56868,19 +58825,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -56916,11 +58875,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -56960,7 +58920,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -56972,7 +58934,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -56999,17 +58961,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -57030,12 +58992,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -57052,8 +59014,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -57087,7 +59049,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -57103,7 +59065,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -57116,19 +59083,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -57259,7 +59235,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -57272,7 +59248,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -57299,12 +59276,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -57314,14 +59292,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -57421,23 +59400,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -57507,7 +59491,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -57566,7 +59552,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -57794,13 +59784,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -57870,7 +59861,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -57885,19 +59877,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -57933,11 +59927,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -57977,7 +59972,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -57989,7 +59986,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -58016,17 +60013,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -58047,12 +60044,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -58069,8 +60066,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -58104,7 +60101,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -58120,7 +60117,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -58133,19 +60135,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -58276,7 +60287,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -58289,7 +60300,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -58316,12 +60328,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -58331,14 +60344,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -58438,23 +60452,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -58524,7 +60543,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -58583,7 +60604,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -58811,13 +60836,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -58887,7 +60913,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -58902,19 +60929,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -58950,11 +60979,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -58994,7 +61024,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -59006,7 +61038,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -59033,17 +61065,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -59064,12 +61096,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -59086,8 +61118,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -59121,7 +61153,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -59137,7 +61169,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -59150,19 +61187,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -59293,7 +61339,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -59306,7 +61352,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -59333,12 +61380,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -59348,14 +61396,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -59455,23 +61504,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -59541,7 +61595,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -59600,7 +61656,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -59828,13 +61888,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -59904,7 +61965,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -59919,19 +61981,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -59967,11 +62031,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -60011,7 +62076,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -60023,7 +62090,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -60050,17 +62117,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -60081,12 +62148,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -60103,8 +62170,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -60138,7 +62205,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -60154,7 +62221,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -60167,19 +62239,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -60310,7 +62391,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -60323,7 +62404,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -60350,12 +62432,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -60365,14 +62448,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -60472,23 +62556,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -60558,7 +62647,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -60617,7 +62708,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -60845,13 +62940,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -60921,7 +63017,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -60936,19 +63033,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -60984,11 +63083,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -61028,7 +63128,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -61040,7 +63142,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -61067,17 +63169,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -61098,12 +63200,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -61120,8 +63222,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -61155,7 +63257,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -61171,7 +63273,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -61184,19 +63291,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -61327,7 +63443,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -61340,7 +63456,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -61367,12 +63484,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -61382,14 +63500,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -61489,23 +63608,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -61575,7 +63699,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -61634,7 +63760,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -61862,13 +63992,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -61938,7 +64069,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -61953,19 +64085,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -62001,11 +64135,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -62045,7 +64180,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -62057,7 +64194,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -62084,17 +64221,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -62115,12 +64252,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -62137,8 +64274,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -62172,7 +64309,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -62188,7 +64325,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -62201,19 +64343,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -62344,7 +64495,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -62357,7 +64508,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -62384,12 +64536,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -62399,14 +64552,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -62506,23 +64660,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -62592,7 +64751,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -62651,7 +64812,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -62879,13 +65044,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -62955,7 +65121,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -62970,19 +65137,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -63018,11 +65187,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -63062,7 +65232,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -63074,7 +65246,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -63101,17 +65273,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -63132,12 +65304,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -63154,8 +65326,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -63189,7 +65361,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -63205,7 +65377,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -63218,19 +65395,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -63361,7 +65547,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -63374,7 +65560,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -63401,12 +65588,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -63416,14 +65604,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -63523,23 +65712,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -63609,7 +65803,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -63668,7 +65864,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -63896,13 +66096,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -63972,7 +66173,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -63987,19 +66189,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -64035,11 +66239,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -64079,7 +66284,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -64091,7 +66298,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -64118,17 +66325,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -64149,12 +66356,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -64171,8 +66378,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -64206,7 +66413,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -64222,7 +66429,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -64235,19 +66447,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -64378,7 +66599,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -64391,7 +66612,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -64418,12 +66640,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -64433,14 +66656,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -64540,23 +66764,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -64626,7 +66855,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -64685,7 +66916,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -64913,13 +67148,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -64989,7 +67225,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -65004,19 +67241,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -65052,11 +67291,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -65096,7 +67336,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -65108,7 +67350,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -65135,17 +67377,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -65166,12 +67408,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -65188,8 +67430,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -65223,7 +67465,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -65239,7 +67481,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -65252,19 +67499,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -65395,7 +67651,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -65408,7 +67664,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -65435,12 +67692,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -65450,14 +67708,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -65557,23 +67816,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -65643,7 +67907,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -65702,7 +67968,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -65930,13 +68200,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -66006,7 +68277,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -66021,19 +68293,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -66069,11 +68343,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -66113,7 +68388,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -66125,7 +68402,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -66152,17 +68429,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -66183,12 +68460,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -66205,8 +68482,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -66240,7 +68517,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -66256,7 +68533,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -66269,19 +68551,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -66412,7 +68703,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -66425,7 +68716,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -66452,12 +68744,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -66467,14 +68760,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -66574,23 +68868,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -66660,7 +68959,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -66719,7 +69020,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -66947,13 +69252,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -67023,7 +69329,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -67038,19 +69345,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -67086,11 +69395,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -67130,7 +69440,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -67142,7 +69454,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -67169,17 +69481,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -67200,12 +69512,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -67222,8 +69534,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -67257,7 +69569,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -67273,7 +69585,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -67286,19 +69603,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -67429,7 +69755,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -67442,7 +69768,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -67469,12 +69796,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -67484,14 +69812,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -67591,23 +69920,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -67677,7 +70011,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -67736,7 +70072,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -67964,13 +70304,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -68040,7 +70381,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -68055,19 +70397,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -68103,11 +70447,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -68147,7 +70492,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -68159,7 +70506,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -68186,17 +70533,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -68217,12 +70564,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -68239,8 +70586,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -68274,7 +70621,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -68290,7 +70637,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -68303,19 +70655,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -68446,7 +70807,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -68459,7 +70820,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -68486,12 +70848,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -68501,14 +70864,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -68608,23 +70972,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -68694,7 +71063,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -68753,7 +71124,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -68981,13 +71356,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -69057,7 +71433,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -69072,19 +71449,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -69120,11 +71499,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -69164,7 +71544,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -69176,7 +71558,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -69203,17 +71585,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -69234,12 +71616,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -69256,8 +71638,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -69291,7 +71673,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -69307,7 +71689,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -69320,19 +71707,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -69463,7 +71859,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -69476,7 +71872,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -69503,12 +71900,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -69518,14 +71916,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -69625,23 +72024,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -69711,7 +72115,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -69770,7 +72176,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -69998,13 +72408,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -70074,7 +72485,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -70089,19 +72501,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -70137,11 +72551,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -70181,7 +72596,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -70193,7 +72610,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -70220,17 +72637,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -70251,12 +72668,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -70273,8 +72690,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -70308,7 +72725,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -70324,7 +72741,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -70337,19 +72759,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -70480,7 +72911,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -70493,7 +72924,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -70520,12 +72952,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -70535,14 +72968,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -70642,23 +73076,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -70728,7 +73167,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -70787,7 +73228,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -71015,13 +73460,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -71091,7 +73537,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -71106,19 +73553,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -71154,11 +73603,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -71198,7 +73648,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -71210,7 +73662,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -71237,17 +73689,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -71268,12 +73720,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -71290,8 +73742,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -71325,7 +73777,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -71341,7 +73793,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -71354,19 +73811,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -71497,7 +73963,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -71510,7 +73976,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -71537,12 +74004,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -71552,14 +74020,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -71659,23 +74128,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -71745,7 +74219,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -71804,7 +74280,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -72032,13 +74512,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -72108,7 +74589,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -72123,19 +74605,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -72171,11 +74655,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -72215,7 +74700,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -72227,7 +74714,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -72254,17 +74741,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -72285,12 +74772,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -72307,8 +74794,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -72342,7 +74829,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -72358,7 +74845,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -72371,19 +74863,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -72514,7 +75015,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -72527,7 +75028,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -72554,12 +75056,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -72569,14 +75072,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -72676,23 +75180,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -72762,7 +75271,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -72821,7 +75332,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -73049,13 +75564,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -73125,7 +75641,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -73140,19 +75657,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -73188,11 +75707,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -73232,7 +75752,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -73244,7 +75766,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -73271,17 +75793,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -73302,12 +75824,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -73324,8 +75846,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -73359,7 +75881,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -73375,7 +75897,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -73388,19 +75915,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -73531,7 +76067,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -73544,7 +76080,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -73571,12 +76108,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -73586,14 +76124,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -73693,23 +76232,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -73779,7 +76323,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -73838,7 +76384,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -74066,13 +76616,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -74142,7 +76693,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -74157,19 +76709,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -74205,11 +76759,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -74249,7 +76804,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -74261,7 +76818,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -74288,17 +76845,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -74319,12 +76876,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -74341,8 +76898,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -74376,7 +76933,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -74392,7 +76949,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -74405,19 +76967,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -74548,7 +77119,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -74561,7 +77132,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -74588,12 +77160,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -74603,14 +77176,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -74710,23 +77284,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -74796,7 +77375,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -74855,7 +77436,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -75083,13 +77668,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -75159,7 +77745,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -75174,19 +77761,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -75222,11 +77811,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -75266,7 +77856,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -75278,7 +77870,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -75305,17 +77897,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -75336,12 +77928,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -75358,8 +77950,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -75393,7 +77985,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -75409,7 +78001,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -75422,19 +78019,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -75565,7 +78171,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -75578,7 +78184,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -75605,12 +78212,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -75620,14 +78228,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -75727,23 +78336,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -75813,7 +78427,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -75872,7 +78488,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -76100,13 +78720,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -76176,7 +78797,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -76191,19 +78813,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -76239,11 +78863,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -76283,7 +78908,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -76295,7 +78922,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -76322,17 +78949,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -76353,12 +78980,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -76375,8 +79002,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -76410,7 +79037,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -76426,7 +79053,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -76439,19 +79071,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -76582,7 +79223,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -76595,7 +79236,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -76622,12 +79264,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -76637,14 +79280,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -76744,23 +79388,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -76830,7 +79479,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -76889,7 +79540,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -77117,13 +79772,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -77193,7 +79849,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -77208,19 +79865,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -77256,11 +79915,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -77300,7 +79960,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -77312,7 +79974,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -77339,17 +80001,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -77370,12 +80032,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -77392,8 +80054,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -77427,7 +80089,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -77443,7 +80105,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -77456,19 +80123,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -77599,7 +80275,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -77612,7 +80288,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -77639,12 +80316,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -77654,14 +80332,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -77761,23 +80440,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -77847,7 +80531,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -77906,7 +80592,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -78134,13 +80824,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -78210,7 +80901,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -78225,19 +80917,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -78273,11 +80967,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -78317,7 +81012,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -78329,7 +81026,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -78356,17 +81053,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -78387,12 +81084,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -78409,8 +81106,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -78444,7 +81141,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -78460,7 +81157,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -78473,19 +81175,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -78616,7 +81327,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -78629,7 +81340,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -78656,12 +81368,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -78671,14 +81384,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -78778,23 +81492,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -78864,7 +81583,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -78923,7 +81644,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -79151,13 +81876,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -79227,7 +81953,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -79242,19 +81969,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -79290,11 +82019,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -79334,7 +82064,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -79346,7 +82078,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -79373,17 +82105,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -79404,12 +82136,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -79426,8 +82158,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -79461,7 +82193,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -79477,7 +82209,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -79490,19 +82227,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -79633,7 +82379,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -79646,7 +82392,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -79673,12 +82420,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -79688,14 +82436,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -79795,23 +82544,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -79881,7 +82635,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -79940,7 +82696,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -80168,13 +82928,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -80244,7 +83005,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -80259,19 +83021,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -80307,11 +83071,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -80351,7 +83116,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -80363,7 +83130,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -80390,17 +83157,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -80421,12 +83188,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -80443,8 +83210,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -80478,7 +83245,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -80494,7 +83261,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -80507,19 +83279,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -80650,7 +83431,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -80663,7 +83444,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -80690,12 +83472,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -80705,14 +83488,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -80812,23 +83596,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -80898,7 +83687,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -80957,7 +83748,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -81185,13 +83980,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -81261,7 +84057,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -81276,19 +84073,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -81324,11 +84123,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -81368,7 +84168,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -81380,7 +84182,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -81407,17 +84209,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -81438,12 +84240,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -81460,8 +84262,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -81495,7 +84297,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -81511,7 +84313,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -81524,19 +84331,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -81667,7 +84483,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -81680,7 +84496,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -81707,12 +84524,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -81722,14 +84540,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -81829,23 +84648,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -81915,7 +84739,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -81974,7 +84800,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -82202,13 +85032,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -82278,7 +85109,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -82293,19 +85125,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -82341,11 +85175,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -82385,7 +85220,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -82397,7 +85234,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -82424,17 +85261,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -82455,12 +85292,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -82477,8 +85314,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -82512,7 +85349,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -82528,7 +85365,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -82541,19 +85383,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -82684,7 +85535,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -82697,7 +85548,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -82724,12 +85576,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -82739,14 +85592,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -82846,23 +85700,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -82932,7 +85791,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -82991,7 +85852,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -83219,13 +86084,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -83295,7 +86161,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -83310,19 +86177,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -83358,11 +86227,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -83402,7 +86272,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -83414,7 +86286,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -83441,17 +86313,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -83472,12 +86344,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -83494,8 +86366,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -83529,7 +86401,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -83545,7 +86417,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -83558,19 +86435,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -83701,7 +86587,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -83714,7 +86600,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -83741,12 +86628,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -83756,14 +86644,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -83863,23 +86752,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -83949,7 +86843,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -84008,7 +86904,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -84236,13 +87136,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -84312,7 +87213,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -84327,19 +87229,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -84375,11 +87279,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -84419,7 +87324,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -84431,7 +87338,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -84458,17 +87365,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -84489,12 +87396,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -84511,8 +87418,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -84546,7 +87453,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -84562,7 +87469,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -84575,19 +87487,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -84718,7 +87639,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -84731,7 +87652,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -84758,12 +87680,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -84773,14 +87696,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -84880,23 +87804,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -84966,7 +87895,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -85025,7 +87956,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -85253,13 +88188,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -85329,7 +88265,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -85344,19 +88281,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -85392,11 +88331,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -85436,7 +88376,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -85448,7 +88390,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -85475,17 +88417,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -85506,12 +88448,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -85528,8 +88470,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -85563,7 +88505,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -85579,7 +88521,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -85592,19 +88539,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -85735,7 +88691,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -85748,7 +88704,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -85775,12 +88732,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -85790,14 +88748,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -85897,23 +88856,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -85983,7 +88947,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -86042,7 +89008,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -86270,13 +89240,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -86346,7 +89317,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -86361,19 +89333,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -86409,11 +89383,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -86453,7 +89428,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -86465,7 +89442,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -86492,17 +89469,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -86523,12 +89500,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -86545,8 +89522,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -86580,7 +89557,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -86596,7 +89573,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -86609,19 +89591,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -86752,7 +89743,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -86765,7 +89756,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -86792,12 +89784,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -86807,14 +89800,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -86914,23 +89908,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -87000,7 +89999,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -87059,7 +90060,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -87287,13 +90292,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -87363,7 +90369,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -87378,19 +90385,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -87426,11 +90435,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -87470,7 +90480,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -87482,7 +90494,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -87509,17 +90521,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -87540,12 +90552,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -87562,8 +90574,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -87597,7 +90609,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -87613,7 +90625,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -87626,19 +90643,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -87769,7 +90795,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -87782,7 +90808,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -87809,12 +90836,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -87824,14 +90852,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -87931,23 +90960,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -88017,7 +91051,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -88076,7 +91112,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -88304,13 +91344,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -88380,7 +91421,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -88395,19 +91437,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -88443,11 +91487,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -88487,7 +91532,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -88499,7 +91546,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -88526,17 +91573,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -88557,12 +91604,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -88579,8 +91626,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -88614,7 +91661,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -88630,7 +91677,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -88643,19 +91695,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -88786,7 +91847,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -88799,7 +91860,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -88826,12 +91888,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -88841,14 +91904,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -88948,23 +92012,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -89034,7 +92103,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -89093,7 +92164,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -89321,13 +92396,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -89397,7 +92473,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -89412,19 +92489,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -89460,11 +92539,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -89504,7 +92584,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -89516,7 +92598,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -89543,17 +92625,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -89574,12 +92656,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -89596,8 +92678,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -89631,7 +92713,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -89647,7 +92729,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -89660,19 +92747,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -89803,7 +92899,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -89816,7 +92912,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -89843,12 +92940,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -89858,14 +92956,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -89965,23 +93064,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -90051,7 +93155,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -90110,7 +93216,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -90338,13 +93448,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -90414,7 +93525,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -90429,19 +93541,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -90477,11 +93591,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -90521,7 +93636,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -90533,7 +93650,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -90560,17 +93677,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -90591,12 +93708,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -90613,8 +93730,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -90648,7 +93765,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -90664,7 +93781,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -90677,19 +93799,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -90820,7 +93951,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -90833,7 +93964,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -90860,12 +93992,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -90875,14 +94008,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -90982,23 +94116,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -91068,7 +94207,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -91127,7 +94268,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -91355,13 +94500,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -91431,7 +94577,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -91446,19 +94593,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -91494,11 +94643,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -91538,7 +94688,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -91550,7 +94702,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -91577,17 +94729,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -91608,12 +94760,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -91630,8 +94782,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -91665,7 +94817,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -91681,7 +94833,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -91694,19 +94851,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -91837,7 +95003,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -91850,7 +95016,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -91877,12 +95044,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -91892,14 +95060,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -91999,23 +95168,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -92085,7 +95259,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -92144,7 +95320,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -92372,13 +95552,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -92448,7 +95629,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -92463,19 +95645,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -92511,11 +95695,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -92555,7 +95740,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -92567,7 +95754,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -92594,17 +95781,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -92625,12 +95812,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -92647,8 +95834,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -92682,7 +95869,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -92698,7 +95885,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -92711,19 +95903,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -92854,7 +96055,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -92867,7 +96068,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -92894,12 +96096,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -92909,14 +96112,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -93016,23 +96220,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -93102,7 +96311,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -93161,7 +96372,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -93389,13 +96604,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -93465,7 +96681,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -93480,19 +96697,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -93528,11 +96747,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -93572,7 +96792,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -93584,7 +96806,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -93611,17 +96833,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -93642,12 +96864,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -93664,8 +96886,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -93699,7 +96921,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -93715,7 +96937,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -93728,19 +96955,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -93871,7 +97107,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -93884,7 +97120,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -93911,12 +97148,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -93926,14 +97164,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -94033,23 +97272,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -94119,7 +97363,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -94178,7 +97424,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -94406,13 +97656,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -94482,7 +97733,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -94497,19 +97749,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -94545,11 +97799,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -94589,7 +97844,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -94601,7 +97858,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -94628,17 +97885,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -94659,12 +97916,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -94681,8 +97938,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -94716,7 +97973,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -94732,7 +97989,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -94745,19 +98007,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -94888,7 +98159,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -94901,7 +98172,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -94928,12 +98200,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -94943,14 +98216,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -95050,23 +98324,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -95136,7 +98415,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -95195,7 +98476,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -95423,13 +98708,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -95499,7 +98785,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -95514,19 +98801,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -95562,11 +98851,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -95606,7 +98896,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -95618,7 +98910,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -95645,17 +98937,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -95676,12 +98968,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -95698,8 +98990,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -95733,7 +99025,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -95749,7 +99041,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -95762,19 +99059,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -95905,7 +99211,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -95918,7 +99224,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -95945,12 +99252,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -95960,14 +99268,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -96067,23 +99376,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -96153,7 +99467,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -96212,7 +99528,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -96440,13 +99760,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -96516,7 +99837,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -96531,19 +99853,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -96579,11 +99903,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -96623,7 +99948,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -96635,7 +99962,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -96662,17 +99989,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -96693,12 +100020,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -96715,8 +100042,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -96750,7 +100077,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -96766,7 +100093,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -96779,19 +100111,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -96922,7 +100263,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -96935,7 +100276,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -96962,12 +100304,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -96977,14 +100320,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -97084,23 +100428,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -97170,7 +100519,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -97229,7 +100580,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -97457,13 +100812,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -97533,7 +100889,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -97548,19 +100905,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -97596,11 +100955,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -97640,7 +101000,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -97652,7 +101014,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -97679,17 +101041,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -97710,12 +101072,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -97732,8 +101094,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -97767,7 +101129,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -97783,7 +101145,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -97796,19 +101163,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -97939,7 +101315,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -97952,7 +101328,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -97979,12 +101356,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -97994,14 +101372,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -98101,23 +101480,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -98187,7 +101571,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -98246,7 +101632,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -98474,13 +101864,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -98550,7 +101941,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -98565,19 +101957,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -98613,11 +102007,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -98657,7 +102052,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -98669,7 +102066,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -98696,17 +102093,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -98727,12 +102124,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -98749,8 +102146,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -98784,7 +102181,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -98800,7 +102197,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -98813,19 +102215,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -98956,7 +102367,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -98969,7 +102380,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -98996,12 +102408,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -99011,14 +102424,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -99118,23 +102532,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -99204,7 +102623,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -99263,7 +102684,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -99491,13 +102916,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -99567,7 +102993,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -99582,19 +103009,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -99630,11 +103059,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -99674,7 +103104,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -99686,7 +103118,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -99713,17 +103145,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -99744,12 +103176,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -99766,8 +103198,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -99801,7 +103233,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -99817,7 +103249,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -99830,19 +103267,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -99973,7 +103419,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -99986,7 +103432,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -100013,12 +103460,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -100028,14 +103476,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -100135,23 +103584,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -100221,7 +103675,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -100280,7 +103736,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -100508,13 +103968,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -100584,7 +104045,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -100599,19 +104061,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -100647,11 +104111,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -100691,7 +104156,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -100703,7 +104170,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -100730,17 +104197,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -100761,12 +104228,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -100783,8 +104250,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -100818,7 +104285,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -100834,7 +104301,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -100847,19 +104319,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -100990,7 +104471,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -101003,7 +104484,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -101030,12 +104512,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -101045,14 +104528,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -101152,23 +104636,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -101238,7 +104727,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -101297,7 +104788,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -101525,13 +105020,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -101601,7 +105097,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -101616,19 +105113,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -101664,11 +105163,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -101708,7 +105208,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -101720,7 +105222,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -101747,17 +105249,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -101778,12 +105280,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -101800,8 +105302,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -101835,7 +105337,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -101851,7 +105353,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -101864,19 +105371,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -102007,7 +105523,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -102020,7 +105536,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -102047,12 +105564,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -102062,14 +105580,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -102169,23 +105688,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -102255,7 +105779,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -102314,7 +105840,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -102542,13 +106072,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -102618,7 +106149,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -102633,19 +106165,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -102681,11 +106215,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -102725,7 +106260,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -102737,7 +106274,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -102764,17 +106301,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -102795,12 +106332,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -102817,8 +106354,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -102852,7 +106389,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -102868,7 +106405,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -102881,19 +106423,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -103024,7 +106575,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -103037,7 +106588,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -103064,12 +106616,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -103079,14 +106632,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -103186,23 +106740,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -103272,7 +106831,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -103331,7 +106892,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -103559,13 +107124,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -103635,7 +107201,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -103650,19 +107217,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -103698,11 +107267,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -103742,7 +107312,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -103754,7 +107326,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -103781,17 +107353,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -103812,12 +107384,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -103834,8 +107406,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -103869,7 +107441,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -103885,7 +107457,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -103898,19 +107475,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -104041,7 +107627,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -104054,7 +107640,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -104081,12 +107668,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -104096,14 +107684,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -104203,23 +107792,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -104289,7 +107883,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -104348,7 +107944,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -104576,13 +108176,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -104652,7 +108253,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -104667,19 +108269,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -104715,11 +108319,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -104759,7 +108364,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -104771,7 +108378,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -104798,17 +108405,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -104829,12 +108436,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -104851,8 +108458,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -104886,7 +108493,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -104902,7 +108509,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -104915,19 +108527,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -105058,7 +108679,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -105071,7 +108692,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -105098,12 +108720,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -105113,14 +108736,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -105220,23 +108844,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -105306,7 +108935,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -105365,7 +108996,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -105593,13 +109228,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -105669,7 +109305,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -105684,19 +109321,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -105732,11 +109371,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -105776,7 +109416,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -105788,7 +109430,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -105815,17 +109457,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -105846,12 +109488,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -105868,8 +109510,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -105903,7 +109545,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -105919,7 +109561,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -105932,19 +109579,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -106075,7 +109731,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -106088,7 +109744,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -106115,12 +109772,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -106130,14 +109788,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -106237,23 +109896,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -106323,7 +109987,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -106382,7 +110048,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -106610,13 +110280,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -106686,7 +110357,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -106701,19 +110373,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -106749,11 +110423,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -106793,7 +110468,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -106805,7 +110482,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -106832,17 +110509,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -106863,12 +110540,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -106885,8 +110562,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -106920,7 +110597,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -106936,7 +110613,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -106949,19 +110631,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -107092,7 +110783,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -107105,7 +110796,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -107132,12 +110824,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -107147,14 +110840,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -107254,23 +110948,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -107340,7 +111039,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -107399,7 +111100,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -107627,13 +111332,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -107703,7 +111409,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -107718,19 +111425,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -107766,11 +111475,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -107810,7 +111520,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -107822,7 +111534,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -107849,17 +111561,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -107880,12 +111592,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -107902,8 +111614,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -107937,7 +111649,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -107953,7 +111665,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -107966,19 +111683,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -108109,7 +111835,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -108122,7 +111848,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -108149,12 +111876,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -108164,14 +111892,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -108271,23 +112000,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -108357,7 +112091,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -108416,7 +112152,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -108644,13 +112384,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -108720,7 +112461,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -108735,19 +112477,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -108783,11 +112527,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -108827,7 +112572,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -108839,7 +112586,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -108866,17 +112613,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -108897,12 +112644,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -108919,8 +112666,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -108954,7 +112701,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -108970,7 +112717,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -108983,19 +112735,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -109126,7 +112887,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -109139,7 +112900,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -109166,12 +112928,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -109181,14 +112944,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -109288,23 +113052,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -109374,7 +113143,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -109433,7 +113204,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -109661,13 +113436,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -109737,7 +113513,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -109752,19 +113529,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -109800,11 +113579,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -109844,7 +113624,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -109856,7 +113638,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -109883,17 +113665,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -109914,12 +113696,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -109936,8 +113718,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -109971,7 +113753,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -109987,7 +113769,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -110000,19 +113787,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -110143,7 +113939,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -110156,7 +113952,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -110183,12 +113980,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -110198,14 +113996,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -110305,23 +114104,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -110391,7 +114195,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -110450,7 +114256,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -110678,13 +114488,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -110754,7 +114565,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -110769,19 +114581,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -110817,11 +114631,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -110861,7 +114676,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -110873,7 +114690,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -110900,17 +114717,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -110931,12 +114748,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -110953,8 +114770,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -110988,7 +114805,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -111004,7 +114821,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -111017,19 +114839,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -111160,7 +114991,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -111173,7 +115004,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -111200,12 +115032,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -111215,14 +115048,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -111322,23 +115156,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -111408,7 +115247,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -111467,7 +115308,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -111695,13 +115540,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -111771,7 +115617,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -111786,19 +115633,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -111834,11 +115683,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -111878,7 +115728,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -111890,7 +115742,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -111917,17 +115769,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -111948,12 +115800,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -111970,8 +115822,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -112005,7 +115857,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -112021,7 +115873,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -112034,19 +115891,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -112177,7 +116043,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -112190,7 +116056,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -112217,12 +116084,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -112232,14 +116100,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -112339,23 +116208,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -112425,7 +116299,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -112484,7 +116360,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -112712,13 +116592,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -112788,7 +116669,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -112803,19 +116685,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -112851,11 +116735,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -112895,7 +116780,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -112907,7 +116794,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -112934,17 +116821,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -112965,12 +116852,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -112987,8 +116874,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -113022,7 +116909,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -113038,7 +116925,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -113051,19 +116943,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -113194,7 +117095,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -113207,7 +117108,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -113234,12 +117136,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -113249,14 +117152,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -113356,23 +117260,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -113442,7 +117351,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -113501,7 +117412,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -113729,13 +117644,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -113805,7 +117721,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -113820,19 +117737,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -113868,11 +117787,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -113912,7 +117832,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -113924,7 +117846,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -113951,17 +117873,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -113982,12 +117904,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -114004,8 +117926,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -114039,7 +117961,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -114055,7 +117977,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -114068,19 +117995,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -114211,7 +118147,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -114224,7 +118160,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -114251,12 +118188,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -114266,14 +118204,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -114373,23 +118312,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -114459,7 +118403,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -114518,7 +118464,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -114746,13 +118696,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -114822,7 +118773,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -114837,19 +118789,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -114885,11 +118839,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -114929,7 +118884,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -114941,7 +118898,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -114968,17 +118925,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -114999,12 +118956,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -115021,8 +118978,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -115056,7 +119013,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -115072,7 +119029,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -115085,19 +119047,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -115228,7 +119199,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -115241,7 +119212,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -115268,12 +119240,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -115283,14 +119256,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -115390,23 +119364,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -115476,7 +119455,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -115535,7 +119516,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -115763,13 +119748,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -115839,7 +119825,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -115854,19 +119841,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -115902,11 +119891,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -115946,7 +119936,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -115958,7 +119950,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -115985,17 +119977,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -116016,12 +120008,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -116038,8 +120030,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -116073,7 +120065,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -116089,7 +120081,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -116102,19 +120099,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -116245,7 +120251,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -116258,7 +120264,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -116285,12 +120292,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -116300,14 +120308,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -116407,23 +120416,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -116493,7 +120507,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -116552,7 +120568,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -116780,13 +120800,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -116856,7 +120877,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -116871,19 +120893,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -116919,11 +120943,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -116963,7 +120988,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -116975,7 +121002,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -117002,17 +121029,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -117033,12 +121060,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -117055,8 +121082,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -117090,7 +121117,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -117106,7 +121133,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -117119,19 +121151,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -117262,7 +121303,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -117275,7 +121316,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -117302,12 +121344,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -117317,14 +121360,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -117424,23 +121468,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -117510,7 +121559,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -117569,7 +121620,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -117797,13 +121852,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -117873,7 +121929,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -117888,19 +121945,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -117936,11 +121995,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -117980,7 +122040,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -117992,7 +122054,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -118019,17 +122081,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -118050,12 +122112,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -118072,8 +122134,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -118107,7 +122169,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -118123,7 +122185,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -118136,19 +122203,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -118279,7 +122355,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -118292,7 +122368,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -118319,12 +122396,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -118334,14 +122412,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -118441,23 +122520,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -118527,7 +122611,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -118586,7 +122672,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -118814,13 +122904,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -118890,7 +122981,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -118905,19 +122997,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -118953,11 +123047,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -118997,7 +123092,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -119009,7 +123106,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -119036,17 +123133,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -119067,12 +123164,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -119089,8 +123186,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -119124,7 +123221,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -119140,7 +123237,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -119153,19 +123255,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -119296,7 +123407,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -119309,7 +123420,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -119336,12 +123448,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -119351,14 +123464,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -119458,23 +123572,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -119544,7 +123663,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -119603,7 +123724,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -119831,13 +123956,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -119907,7 +124033,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -119922,19 +124049,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -119970,11 +124099,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -120014,7 +124144,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -120026,7 +124158,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -120053,17 +124185,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -120084,12 +124216,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -120106,8 +124238,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -120141,7 +124273,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -120157,7 +124289,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -120170,19 +124307,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -120313,7 +124459,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -120326,7 +124472,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -120353,12 +124500,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -120368,14 +124516,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -120475,23 +124624,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -120561,7 +124715,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -120620,7 +124776,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -120848,13 +125008,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -120924,7 +125085,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -120939,19 +125101,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -120987,11 +125151,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -121031,7 +125196,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -121043,7 +125210,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -121070,17 +125237,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -121101,12 +125268,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -121123,8 +125290,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -121158,7 +125325,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -121174,7 +125341,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -121187,19 +125359,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -121330,7 +125511,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -121343,7 +125524,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -121370,12 +125552,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -121385,14 +125568,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -121492,23 +125676,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -121578,7 +125767,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -121637,7 +125828,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -121865,13 +126060,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -121941,7 +126137,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -121956,19 +126153,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -122004,11 +126203,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -122048,7 +126248,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -122060,7 +126262,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -122087,17 +126289,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -122118,12 +126320,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -122140,8 +126342,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -122175,7 +126377,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -122191,7 +126393,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -122204,19 +126411,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -122347,7 +126563,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -122360,7 +126576,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -122387,12 +126604,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -122402,14 +126620,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -122509,23 +126728,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -122595,7 +126819,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -122654,7 +126880,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -122882,13 +127112,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -122958,7 +127189,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -122973,19 +127205,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -123021,11 +127255,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -123065,7 +127300,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -123077,7 +127314,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -123104,17 +127341,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -123135,12 +127372,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -123157,8 +127394,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -123192,7 +127429,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -123208,7 +127445,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -123221,19 +127463,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -123364,7 +127615,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -123377,7 +127628,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -123404,12 +127656,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -123419,14 +127672,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -123526,23 +127780,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -123612,7 +127871,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -123671,7 +127932,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -123899,13 +128164,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -123975,7 +128241,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -123990,19 +128257,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -124038,11 +128307,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -124082,7 +128352,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -124094,7 +128366,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -124121,17 +128393,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -124152,12 +128424,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -124174,8 +128446,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -124209,7 +128481,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -124225,7 +128497,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -124238,19 +128515,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -124381,7 +128667,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -124394,7 +128680,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -124421,12 +128708,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -124436,14 +128724,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -124543,23 +128832,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -124629,7 +128923,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -124688,7 +128984,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -124916,13 +129216,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -124992,7 +129293,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -125007,19 +129309,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -125055,11 +129359,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -125099,7 +129404,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -125111,7 +129418,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -125138,17 +129445,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -125169,12 +129476,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -125191,8 +129498,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -125226,7 +129533,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -125242,7 +129549,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -125255,19 +129567,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -125398,7 +129719,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -125411,7 +129732,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -125438,12 +129760,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -125453,14 +129776,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -125560,23 +129884,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -125646,7 +129975,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -125705,7 +130036,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -125933,13 +130268,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -126009,7 +130345,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -126024,19 +130361,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -126072,11 +130411,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -126116,7 +130456,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -126128,7 +130470,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -126155,17 +130497,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -126186,12 +130528,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -126208,8 +130550,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -126243,7 +130585,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -126259,7 +130601,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -126272,19 +130619,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -126415,7 +130771,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -126428,7 +130784,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -126455,12 +130812,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -126470,14 +130828,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -126577,23 +130936,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -126663,7 +131027,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -126722,7 +131088,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -126950,13 +131320,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -127026,7 +131397,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -127041,19 +131413,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -127089,11 +131463,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -127133,7 +131508,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -127145,7 +131522,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -127172,17 +131549,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -127203,12 +131580,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -127225,8 +131602,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -127260,7 +131637,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -127276,7 +131653,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -127289,19 +131671,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -127432,7 +131823,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -127445,7 +131836,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -127472,12 +131864,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -127487,14 +131880,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -127594,23 +131988,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -127680,7 +132079,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -127739,7 +132140,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -127967,13 +132372,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -128043,7 +132449,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -128058,19 +132465,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -128106,11 +132515,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -128150,7 +132560,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -128162,7 +132574,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -128189,17 +132601,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -128220,12 +132632,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -128242,8 +132654,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -128277,7 +132689,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -128293,7 +132705,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -128306,19 +132723,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -128449,7 +132875,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -128462,7 +132888,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -128489,12 +132916,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -128504,14 +132932,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -128611,23 +133040,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -128697,7 +133131,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -128756,7 +133192,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -128984,13 +133424,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -129060,7 +133501,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -129075,19 +133517,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -129123,11 +133567,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -129167,7 +133612,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -129179,7 +133626,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -129206,17 +133653,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -129237,12 +133684,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -129259,8 +133706,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -129294,7 +133741,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -129310,7 +133757,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -129323,19 +133775,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -129466,7 +133927,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -129479,7 +133940,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -129506,12 +133968,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -129521,14 +133984,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -129628,23 +134092,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -129714,7 +134183,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -129773,7 +134244,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -130001,13 +134476,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -130077,7 +134553,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -130092,19 +134569,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -130140,11 +134619,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -130184,7 +134664,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -130196,7 +134678,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -130223,17 +134705,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -130254,12 +134736,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -130276,8 +134758,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -130311,7 +134793,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -130327,7 +134809,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -130340,19 +134827,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -130483,7 +134979,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -130496,7 +134992,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -130523,12 +135020,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -130538,14 +135036,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -130645,23 +135144,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -130731,7 +135235,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -130790,7 +135296,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -131018,13 +135528,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -131094,7 +135605,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -131109,19 +135621,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -131157,11 +135671,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -131201,7 +135716,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -131213,7 +135730,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -131240,17 +135757,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -131271,12 +135788,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -131293,8 +135810,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -131328,7 +135845,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -131344,7 +135861,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -131357,19 +135879,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -131500,7 +136031,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -131513,7 +136044,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -131540,12 +136072,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -131555,14 +136088,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -131662,23 +136196,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -131748,7 +136287,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -131807,7 +136348,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -132035,13 +136580,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -132111,7 +136657,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -132126,19 +136673,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -132174,11 +136723,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -132218,7 +136768,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -132230,7 +136782,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -132257,17 +136809,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -132288,12 +136840,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -132310,8 +136862,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -132345,7 +136897,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -132361,7 +136913,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -132374,19 +136931,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -132517,7 +137083,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -132530,7 +137096,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -132557,12 +137124,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -132572,14 +137140,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -132679,23 +137248,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -132765,7 +137339,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -132824,7 +137400,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -133052,13 +137632,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -133128,7 +137709,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -133143,19 +137725,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -133191,11 +137775,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -133235,7 +137820,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -133247,7 +137834,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -133274,17 +137861,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -133305,12 +137892,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -133327,8 +137914,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -133362,7 +137949,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -133378,7 +137965,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -133391,19 +137983,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -133534,7 +138135,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -133547,7 +138148,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -133574,12 +138176,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -133589,14 +138192,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -133696,23 +138300,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -133782,7 +138391,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -133841,7 +138452,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -134069,13 +138684,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -134145,7 +138761,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -134160,19 +138777,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -134208,11 +138827,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -134252,7 +138872,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -134264,7 +138886,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -134291,17 +138913,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -134322,12 +138944,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -134344,8 +138966,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -134379,7 +139001,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -134395,7 +139017,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -134408,19 +139035,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -134551,7 +139187,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -134564,7 +139200,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -134591,12 +139228,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -134606,14 +139244,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -134713,23 +139352,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -134799,7 +139443,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -134858,7 +139504,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -135086,13 +139736,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -135162,7 +139813,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -135177,19 +139829,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -135225,11 +139879,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -135269,7 +139924,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -135281,7 +139938,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -135308,17 +139965,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -135339,12 +139996,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -135361,8 +140018,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -135396,7 +140053,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -135412,7 +140069,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -135425,19 +140087,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -135568,7 +140239,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -135581,7 +140252,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -135608,12 +140280,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -135623,14 +140296,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -135730,23 +140404,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -135816,7 +140495,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -135875,7 +140556,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -136103,13 +140788,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -136179,7 +140865,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -136194,19 +140881,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -136242,11 +140931,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -136286,7 +140976,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -136298,7 +140990,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -136325,17 +141017,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -136356,12 +141048,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -136378,8 +141070,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -136413,7 +141105,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -136429,7 +141121,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -136442,19 +141139,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -136585,7 +141291,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -136598,7 +141304,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -136625,12 +141332,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -136640,14 +141348,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -136747,23 +141456,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -136833,7 +141547,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -136892,7 +141608,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -137120,13 +141840,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -137196,7 +141917,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -137211,19 +141933,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -137259,11 +141983,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -137303,7 +142028,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -137315,7 +142042,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -137342,17 +142069,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -137373,12 +142100,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -137395,8 +142122,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -137430,7 +142157,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -137446,7 +142173,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -137459,19 +142191,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -137602,7 +142343,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -137615,7 +142356,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -137642,12 +142384,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -137657,14 +142400,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -137764,23 +142508,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -137850,7 +142599,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -137909,7 +142660,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -138137,13 +142892,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -138213,7 +142969,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -138228,19 +142985,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -138276,11 +143035,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -138320,7 +143080,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -138332,7 +143094,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -138359,17 +143121,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -138390,12 +143152,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -138412,8 +143174,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -138447,7 +143209,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -138463,7 +143225,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -138476,19 +143243,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -138619,7 +143395,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -138632,7 +143408,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -138659,12 +143436,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -138674,14 +143452,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -138781,23 +143560,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -138867,7 +143651,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -138926,7 +143712,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -139154,13 +143944,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -139230,7 +144021,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -139245,19 +144037,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -139293,11 +144087,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -139337,7 +144132,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -139349,7 +144146,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -139376,17 +144173,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -139407,12 +144204,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -139429,8 +144226,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -139464,7 +144261,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -139480,7 +144277,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -139493,19 +144295,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -139636,7 +144447,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -139649,7 +144460,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -139676,12 +144488,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -139691,14 +144504,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -139798,23 +144612,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -139884,7 +144703,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -139943,7 +144764,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -140171,13 +144996,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -140247,7 +145073,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -140262,19 +145089,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -140310,11 +145139,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -140354,7 +145184,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -140366,7 +145198,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -140393,17 +145225,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -140424,12 +145256,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -140446,8 +145278,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -140481,7 +145313,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -140497,7 +145329,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -140510,19 +145347,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -140653,7 +145499,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -140666,7 +145512,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -140693,12 +145540,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -140708,14 +145556,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -140815,23 +145664,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -140901,7 +145755,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -140960,7 +145816,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -141188,13 +146048,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -141264,7 +146125,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -141279,19 +146141,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -141327,11 +146191,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -141371,7 +146236,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -141383,7 +146250,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -141410,17 +146277,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -141441,12 +146308,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -141463,8 +146330,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -141498,7 +146365,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -141514,7 +146381,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -141527,19 +146399,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -141670,7 +146551,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -141683,7 +146564,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -141710,12 +146592,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -141725,14 +146608,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -141832,23 +146716,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -141918,7 +146807,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -141977,7 +146868,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -142205,13 +147100,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -142281,7 +147177,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -142296,19 +147193,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -142344,11 +147243,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -142388,7 +147288,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -142400,7 +147302,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -142427,17 +147329,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -142458,12 +147360,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -142480,8 +147382,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -142515,7 +147417,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -142531,7 +147433,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -142544,19 +147451,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -142687,7 +147603,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -142700,7 +147616,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -142727,12 +147644,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -142742,14 +147660,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -142849,23 +147768,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -142935,7 +147859,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -142994,7 +147920,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -143222,13 +148152,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -143298,7 +148229,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -143313,19 +148245,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -143361,11 +148295,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -143405,7 +148340,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -143417,7 +148354,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -143444,17 +148381,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -143475,12 +148412,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -143497,8 +148434,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -143532,7 +148469,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -143548,7 +148485,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -143561,19 +148503,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -143704,7 +148655,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -143717,7 +148668,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -143744,12 +148696,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -143759,14 +148712,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -143866,23 +148820,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -143952,7 +148911,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -144011,7 +148972,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -144239,13 +149204,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -144315,7 +149281,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -144330,19 +149297,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -144378,11 +149347,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -144422,7 +149392,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -144434,7 +149406,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -144461,17 +149433,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -144492,12 +149464,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -144514,8 +149486,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -144549,7 +149521,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -144565,7 +149537,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -144578,19 +149555,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -144721,7 +149707,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -144734,7 +149720,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -144761,12 +149748,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -144776,14 +149764,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -144883,23 +149872,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -144969,7 +149963,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -145028,7 +150024,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -145256,13 +150256,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -145332,7 +150333,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -145347,19 +150349,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -145395,11 +150399,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -145439,7 +150444,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -145451,7 +150458,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -145478,17 +150485,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -145509,12 +150516,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -145531,8 +150538,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -145566,7 +150573,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -145582,7 +150589,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -145595,19 +150607,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -145738,7 +150759,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -145751,7 +150772,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -145778,12 +150800,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -145793,14 +150816,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -145900,23 +150924,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -145986,7 +151015,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -146045,7 +151076,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -146273,13 +151308,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -146349,7 +151385,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -146364,19 +151401,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -146412,11 +151451,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -146456,7 +151496,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -146468,7 +151510,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -146495,17 +151537,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -146526,12 +151568,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -146548,8 +151590,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -146583,7 +151625,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -146599,7 +151641,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -146612,19 +151659,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -146755,7 +151811,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -146768,7 +151824,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -146795,12 +151852,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -146810,14 +151868,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -146917,23 +151976,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -147003,7 +152067,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -147062,7 +152128,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -147290,13 +152360,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -147366,7 +152437,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -147381,19 +152453,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -147429,11 +152503,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -147473,7 +152548,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -147485,7 +152562,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -147512,17 +152589,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -147543,12 +152620,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -147565,8 +152642,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -147600,7 +152677,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -147616,7 +152693,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -147629,19 +152711,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -147772,7 +152863,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -147785,7 +152876,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -147812,12 +152904,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -147827,14 +152920,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -147934,23 +153028,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -148020,7 +153119,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -148079,7 +153180,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -148307,13 +153412,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -148383,7 +153489,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -148398,19 +153505,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -148446,11 +153555,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -148490,7 +153600,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -148502,7 +153614,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -148529,17 +153641,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -148560,12 +153672,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -148582,8 +153694,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -148617,7 +153729,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -148633,7 +153745,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -148646,19 +153763,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -148789,7 +153915,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -148802,7 +153928,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -148829,12 +153956,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -148844,14 +153972,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -148951,23 +154080,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -149037,7 +154171,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -149096,7 +154232,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -149324,13 +154464,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -149400,7 +154541,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -149415,19 +154557,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -149463,11 +154607,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -149507,7 +154652,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -149519,7 +154666,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -149546,17 +154693,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -149577,12 +154724,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -149599,8 +154746,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -149634,7 +154781,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -149650,7 +154797,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -149663,19 +154815,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -149806,7 +154967,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -149819,7 +154980,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -149846,12 +155008,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -149861,14 +155024,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -149968,23 +155132,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -150054,7 +155223,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -150113,7 +155284,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -150341,13 +155516,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -150417,7 +155593,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -150432,19 +155609,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -150480,11 +155659,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -150524,7 +155704,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -150536,7 +155718,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -150563,17 +155745,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -150594,12 +155776,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -150616,8 +155798,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -150651,7 +155833,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -150667,7 +155849,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -150680,19 +155867,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -150823,7 +156019,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -150836,7 +156032,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -150863,12 +156060,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -150878,14 +156076,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -150985,23 +156184,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -151071,7 +156275,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -151130,7 +156336,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -151358,13 +156568,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -151434,7 +156645,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -151449,19 +156661,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -151497,11 +156711,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -151541,7 +156756,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -151553,7 +156770,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -151580,17 +156797,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -151611,12 +156828,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -151633,8 +156850,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -151668,7 +156885,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -151684,7 +156901,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -151697,19 +156919,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -151840,7 +157071,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -151853,7 +157084,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -151880,12 +157112,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -151895,14 +157128,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -152002,23 +157236,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -152088,7 +157327,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -152147,7 +157388,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -152375,13 +157620,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -152451,7 +157697,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -152466,19 +157713,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -152514,11 +157763,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -152558,7 +157808,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -152570,7 +157822,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -152597,17 +157849,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -152628,12 +157880,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -152650,8 +157902,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -152685,7 +157937,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -152701,7 +157953,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -152714,19 +157971,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -152857,7 +158123,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -152870,7 +158136,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -152897,12 +158164,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -152912,14 +158180,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -153019,23 +158288,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -153105,7 +158379,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -153164,7 +158440,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -153392,13 +158672,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -153468,7 +158749,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -153483,19 +158765,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -153531,11 +158815,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -153575,7 +158860,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -153587,7 +158874,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -153614,17 +158901,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -153645,12 +158932,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -153667,8 +158954,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -153702,7 +158989,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -153718,7 +159005,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -153731,19 +159023,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -153874,7 +159175,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -153887,7 +159188,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -153914,12 +159216,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -153929,14 +159232,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -154036,23 +159340,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -154122,7 +159431,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -154181,7 +159492,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -154409,13 +159724,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -154485,7 +159801,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -154500,19 +159817,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -154548,11 +159867,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -154592,7 +159912,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -154604,7 +159926,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -154631,17 +159953,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -154662,12 +159984,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -154684,8 +160006,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -154719,7 +160041,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -154735,7 +160057,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -154748,19 +160075,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -154891,7 +160227,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -154904,7 +160240,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -154931,12 +160268,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -154946,14 +160284,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -155053,23 +160392,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -155139,7 +160483,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -155198,7 +160544,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -155426,13 +160776,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -155502,7 +160853,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -155517,19 +160869,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -155565,11 +160919,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -155609,7 +160964,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -155621,7 +160978,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -155648,17 +161005,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -155679,12 +161036,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -155701,8 +161058,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -155736,7 +161093,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -155752,7 +161109,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -155765,19 +161127,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -155908,7 +161279,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -155921,7 +161292,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -155948,12 +161320,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -155963,14 +161336,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -156070,23 +161444,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -156156,7 +161535,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -156215,7 +161596,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -156443,13 +161828,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -156519,7 +161905,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -156534,19 +161921,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -156582,11 +161971,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -156626,7 +162016,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -156638,7 +162030,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -156665,17 +162057,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -156696,12 +162088,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -156718,8 +162110,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -156753,7 +162145,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -156769,7 +162161,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -156782,19 +162179,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -156925,7 +162331,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -156938,7 +162344,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -156965,12 +162372,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -156980,14 +162388,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -157087,23 +162496,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -157173,7 +162587,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -157232,7 +162648,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -157460,13 +162880,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -157536,7 +162957,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -157551,19 +162973,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -157599,11 +163023,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -157643,7 +163068,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -157655,7 +163082,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -157682,17 +163109,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -157713,12 +163140,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -157735,8 +163162,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -157770,7 +163197,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -157786,7 +163213,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -157799,19 +163231,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -157942,7 +163383,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -157955,7 +163396,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -157982,12 +163424,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -157997,14 +163440,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -158104,23 +163548,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -158190,7 +163639,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -158249,7 +163700,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -158477,13 +163932,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -158553,7 +164009,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -158568,19 +164025,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -158616,11 +164075,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -158660,7 +164120,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -158672,7 +164134,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -158699,17 +164161,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -158730,12 +164192,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -158752,8 +164214,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -158787,7 +164249,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -158803,7 +164265,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -158816,19 +164283,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -158959,7 +164435,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -158972,7 +164448,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -158999,12 +164476,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -159014,14 +164492,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -159121,23 +164600,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -159207,7 +164691,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -159266,7 +164752,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -159494,13 +164984,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -159570,7 +165061,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -159585,19 +165077,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -159633,11 +165127,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -159677,7 +165172,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -159689,7 +165186,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -159716,17 +165213,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -159747,12 +165244,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -159769,8 +165266,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -159804,7 +165301,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -159820,7 +165317,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -159833,19 +165335,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -159976,7 +165487,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -159989,7 +165500,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -160016,12 +165528,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -160031,14 +165544,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -160138,23 +165652,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -160224,7 +165743,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -160283,7 +165804,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -160511,13 +166036,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -160587,7 +166113,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -160602,19 +166129,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -160650,11 +166179,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -160694,7 +166224,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -160706,7 +166238,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -160733,17 +166265,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -160764,12 +166296,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -160786,8 +166318,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -160821,7 +166353,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -160837,7 +166369,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -160850,19 +166387,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -160993,7 +166539,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -161006,7 +166552,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -161033,12 +166580,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -161048,14 +166596,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -161155,23 +166704,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -161241,7 +166795,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -161300,7 +166856,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -161528,13 +167088,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -161604,7 +167165,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -161619,19 +167181,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -161667,11 +167231,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -161711,7 +167276,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -161723,7 +167290,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -161750,17 +167317,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -161781,12 +167348,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -161803,8 +167370,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -161838,7 +167405,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -161854,7 +167421,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -161867,19 +167439,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -162010,7 +167591,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -162023,7 +167604,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -162050,12 +167632,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -162065,14 +167648,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -162172,23 +167756,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -162258,7 +167847,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -162317,7 +167908,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -162545,13 +168140,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -162621,7 +168217,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -162636,19 +168233,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -162684,11 +168283,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -162728,7 +168328,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -162740,7 +168342,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -162767,17 +168369,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -162798,12 +168400,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -162820,8 +168422,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -162855,7 +168457,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -162871,7 +168473,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -162884,19 +168491,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -163027,7 +168643,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -163040,7 +168656,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -163067,12 +168684,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -163082,14 +168700,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -163189,23 +168808,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -163275,7 +168899,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -163334,7 +168960,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -163562,13 +169192,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -163638,7 +169269,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -163653,19 +169285,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -163701,11 +169335,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -163745,7 +169380,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -163757,7 +169394,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -163784,17 +169421,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -163815,12 +169452,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -163837,8 +169474,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -163872,7 +169509,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -163888,7 +169525,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -163901,19 +169543,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -164044,7 +169695,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -164057,7 +169708,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -164084,12 +169736,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -164099,14 +169752,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -164206,23 +169860,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -164292,7 +169951,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -164351,7 +170012,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -164579,13 +170244,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -164655,7 +170321,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -164670,19 +170337,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -164718,11 +170387,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -164762,7 +170432,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -164774,7 +170446,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -164801,17 +170473,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -164832,12 +170504,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -164854,8 +170526,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -164889,7 +170561,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -164905,7 +170577,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -164918,19 +170595,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -165061,7 +170747,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -165074,7 +170760,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -165101,12 +170788,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -165116,14 +170804,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -165223,23 +170912,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -165309,7 +171003,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -165368,7 +171064,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -165596,13 +171296,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -165672,7 +171373,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -165687,19 +171389,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -165735,11 +171439,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -165779,7 +171484,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -165791,7 +171498,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -165818,17 +171525,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -165849,12 +171556,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -165871,8 +171578,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -165906,7 +171613,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -165922,7 +171629,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -165935,19 +171647,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -166078,7 +171799,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -166091,7 +171812,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -166118,12 +171840,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -166133,14 +171856,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -166240,23 +171964,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -166326,7 +172055,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -166385,7 +172116,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -166613,13 +172348,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -166689,7 +172425,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -166704,19 +172441,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -166752,11 +172491,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -166796,7 +172536,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -166808,7 +172550,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -166835,17 +172577,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -166866,12 +172608,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -166888,8 +172630,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -166923,7 +172665,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -166939,7 +172681,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -166952,19 +172699,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -167095,7 +172851,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -167108,7 +172864,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -167135,12 +172892,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -167150,14 +172908,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -167257,23 +173016,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -167343,7 +173107,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -167402,7 +173168,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -167630,13 +173400,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -167706,7 +173477,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -167721,19 +173493,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -167769,11 +173543,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -167813,7 +173588,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -167825,7 +173602,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -167852,17 +173629,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -167883,12 +173660,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -167905,8 +173682,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -167940,7 +173717,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -167956,7 +173733,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -167969,19 +173751,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -168112,7 +173903,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -168125,7 +173916,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -168152,12 +173944,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -168167,14 +173960,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -168274,23 +174068,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -168360,7 +174159,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -168419,7 +174220,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -168647,13 +174452,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -168723,7 +174529,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -168738,19 +174545,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -168786,11 +174595,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -168830,7 +174640,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -168842,7 +174654,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -168869,17 +174681,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -168900,12 +174712,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -168922,8 +174734,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -168957,7 +174769,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -168973,7 +174785,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -168986,19 +174803,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -169129,7 +174955,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -169142,7 +174968,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -169169,12 +174996,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -169184,14 +175012,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -169291,23 +175120,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -169377,7 +175211,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -169436,7 +175272,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -169664,13 +175504,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -169740,7 +175581,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -169755,19 +175597,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -169803,11 +175647,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -169847,7 +175692,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -169859,7 +175706,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -169886,17 +175733,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -169917,12 +175764,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -169939,8 +175786,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -169974,7 +175821,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -169990,7 +175837,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -170003,19 +175855,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -170146,7 +176007,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -170159,7 +176020,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -170186,12 +176048,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -170201,14 +176064,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -170308,23 +176172,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -170394,7 +176263,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -170453,7 +176324,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -170681,13 +176556,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -170757,7 +176633,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -170772,19 +176649,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -170820,11 +176699,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -170864,7 +176744,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -170876,7 +176758,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -170903,17 +176785,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -170934,12 +176816,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -170956,8 +176838,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -170991,7 +176873,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -171007,7 +176889,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -171020,19 +176907,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -171163,7 +177059,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -171176,7 +177072,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -171203,12 +177100,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -171218,14 +177116,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -171325,23 +177224,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -171411,7 +177315,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -171470,7 +177376,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -171698,13 +177608,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -171774,7 +177685,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -171789,19 +177701,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -171837,11 +177751,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -171881,7 +177796,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -171893,7 +177810,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -171920,17 +177837,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -171951,12 +177868,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -171973,8 +177890,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -172008,7 +177925,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -172024,7 +177941,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -172037,19 +177959,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -172180,7 +178111,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -172193,7 +178124,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -172220,12 +178152,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -172235,14 +178168,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -172342,23 +178276,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -172428,7 +178367,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -172487,7 +178428,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -172715,13 +178660,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -172791,7 +178737,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -172806,19 +178753,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -172854,11 +178803,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -172898,7 +178848,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -172910,7 +178862,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -172937,17 +178889,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -172968,12 +178920,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -172990,8 +178942,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -173025,7 +178977,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -173041,7 +178993,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -173054,19 +179011,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -173197,7 +179163,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -173210,7 +179176,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -173237,12 +179204,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -173252,14 +179220,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -173359,23 +179328,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -173445,7 +179419,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -173504,7 +179480,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -173732,13 +179712,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -173808,7 +179789,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -173823,19 +179805,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -173871,11 +179855,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -173915,7 +179900,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -173927,7 +179914,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -173954,17 +179941,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -173985,12 +179972,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -174007,8 +179994,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -174042,7 +180029,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -174058,7 +180045,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -174071,19 +180063,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -174214,7 +180215,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -174227,7 +180228,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -174254,12 +180256,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -174269,14 +180272,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -174376,23 +180380,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -174462,7 +180471,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -174521,7 +180532,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -174749,13 +180764,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -174825,7 +180841,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -174840,19 +180857,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -174888,11 +180907,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -174932,7 +180952,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -174944,7 +180966,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -174971,17 +180993,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -175002,12 +181024,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -175024,8 +181046,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -175059,7 +181081,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -175075,7 +181097,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -175088,19 +181115,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -175231,7 +181267,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -175244,7 +181280,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -175271,12 +181308,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -175286,14 +181324,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -175393,23 +181432,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -175479,7 +181523,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -175538,7 +181584,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -175766,13 +181816,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -175842,7 +181893,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -175857,19 +181909,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -175905,11 +181959,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -175949,7 +182004,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -175961,7 +182018,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -175988,17 +182045,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -176019,12 +182076,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -176041,8 +182098,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -176076,7 +182133,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -176092,7 +182149,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -176105,19 +182167,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -176248,7 +182319,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -176261,7 +182332,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -176288,12 +182360,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -176303,14 +182376,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -176410,23 +182484,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -176496,7 +182575,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -176555,7 +182636,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -176783,13 +182868,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -176859,7 +182945,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -176874,19 +182961,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -176922,11 +183011,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -176966,7 +183056,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -176978,7 +183070,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -177005,17 +183097,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -177036,12 +183128,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -177058,8 +183150,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -177093,7 +183185,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -177109,7 +183201,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -177122,19 +183219,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -177265,7 +183371,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -177278,7 +183384,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -177305,12 +183412,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -177320,14 +183428,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -177427,23 +183536,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -177513,7 +183627,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -177572,7 +183688,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -177800,13 +183920,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -177876,7 +183997,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -177891,19 +184013,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -177939,11 +184063,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -177983,7 +184108,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -177995,7 +184122,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -178022,17 +184149,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -178053,12 +184180,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -178075,8 +184202,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -178110,7 +184237,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -178126,7 +184253,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -178139,19 +184271,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -178282,7 +184423,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -178295,7 +184436,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -178322,12 +184464,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -178337,14 +184480,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -178444,23 +184588,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -178530,7 +184679,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -178589,7 +184740,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -178817,13 +184972,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -178893,7 +185049,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -178908,19 +185065,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -178956,11 +185115,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -179000,7 +185160,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -179012,7 +185174,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -179039,17 +185201,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -179070,12 +185232,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -179092,8 +185254,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -179127,7 +185289,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -179143,7 +185305,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -179156,19 +185323,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -179299,7 +185475,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -179312,7 +185488,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -179339,12 +185516,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -179354,14 +185532,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -179461,23 +185640,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -179547,7 +185731,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -179606,7 +185792,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -179834,13 +186024,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -179910,7 +186101,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -179925,19 +186117,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -179973,11 +186167,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -180017,7 +186212,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -180029,7 +186226,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -180056,17 +186253,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -180087,12 +186284,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -180109,8 +186306,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -180144,7 +186341,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -180160,7 +186357,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -180173,19 +186375,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -180316,7 +186527,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -180329,7 +186540,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -180356,12 +186568,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -180371,14 +186584,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -180478,23 +186692,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -180564,7 +186783,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -180623,7 +186844,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -180851,13 +187076,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -180927,7 +187153,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -180942,19 +187169,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -180990,11 +187219,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -181034,7 +187264,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -181046,7 +187278,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -181073,17 +187305,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -181104,12 +187336,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -181126,8 +187358,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -181161,7 +187393,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -181177,7 +187409,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -181190,19 +187427,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -181333,7 +187579,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -181346,7 +187592,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -181373,12 +187620,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -181388,14 +187636,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -181495,23 +187744,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -181581,7 +187835,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -181640,7 +187896,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -181868,13 +188128,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -181944,7 +188205,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -181959,19 +188221,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -182007,11 +188271,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -182051,7 +188316,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -182063,7 +188330,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -182090,17 +188357,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -182121,12 +188388,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -182143,8 +188410,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -182178,7 +188445,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -182194,7 +188461,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -182207,19 +188479,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -182350,7 +188631,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -182363,7 +188644,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -182390,12 +188672,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -182405,14 +188688,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -182512,23 +188796,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -182598,7 +188887,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -182657,7 +188948,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -182885,13 +189180,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -182961,7 +189257,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -182976,19 +189273,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -183024,11 +189323,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -183068,7 +189368,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -183080,7 +189382,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -183107,17 +189409,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -183138,12 +189440,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -183160,8 +189462,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -183195,7 +189497,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -183211,7 +189513,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -183224,19 +189531,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -183367,7 +189683,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -183380,7 +189696,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -183407,12 +189724,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -183422,14 +189740,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -183529,23 +189848,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -183615,7 +189939,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -183674,7 +190000,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -183902,13 +190232,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -183978,7 +190309,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -183993,19 +190325,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -184041,11 +190375,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -184085,7 +190420,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -184097,7 +190434,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -184124,17 +190461,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -184155,12 +190492,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -184177,8 +190514,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -184212,7 +190549,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -184228,7 +190565,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -184241,19 +190583,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -184384,7 +190735,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -184397,7 +190748,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -184424,12 +190776,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -184439,14 +190792,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -184546,23 +190900,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -184632,7 +190991,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -184691,7 +191052,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -184919,13 +191284,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -184995,7 +191361,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -185010,19 +191377,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -185058,11 +191427,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -185102,7 +191472,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -185114,7 +191486,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -185141,17 +191513,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -185172,12 +191544,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -185194,8 +191566,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -185229,7 +191601,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -185245,7 +191617,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -185258,19 +191635,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -185401,7 +191787,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -185414,7 +191800,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -185441,12 +191828,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -185456,14 +191844,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -185563,23 +191952,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -185649,7 +192043,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -185708,7 +192104,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -185936,13 +192336,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -186012,7 +192413,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -186027,19 +192429,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -186075,11 +192479,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -186119,7 +192524,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -186131,7 +192538,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -186158,17 +192565,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -186189,12 +192596,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -186211,8 +192618,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -186246,7 +192653,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -186262,7 +192669,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -186275,19 +192687,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -186418,7 +192839,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -186431,7 +192852,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -186458,12 +192880,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -186473,14 +192896,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -186580,23 +193004,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -186666,7 +193095,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -186725,7 +193156,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -186953,13 +193388,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -187029,7 +193465,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -187044,19 +193481,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -187092,11 +193531,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -187136,7 +193576,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -187148,7 +193590,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -187175,17 +193617,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -187206,12 +193648,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -187228,8 +193670,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -187263,7 +193705,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -187279,7 +193721,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -187292,19 +193739,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -187435,7 +193891,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -187448,7 +193904,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -187475,12 +193932,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -187490,14 +193948,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -187597,23 +194056,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -187683,7 +194147,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -187742,7 +194208,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -187970,13 +194440,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -188046,7 +194517,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -188061,19 +194533,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -188109,11 +194583,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -188153,7 +194628,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -188165,7 +194642,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -188192,17 +194669,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -188223,12 +194700,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -188245,8 +194722,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -188280,7 +194757,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -188296,7 +194773,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -188309,19 +194791,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -188452,7 +194943,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -188465,7 +194956,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -188492,12 +194984,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -188507,14 +195000,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -188614,23 +195108,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -188700,7 +195199,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -188759,7 +195260,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -188987,13 +195492,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -189063,7 +195569,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -189078,19 +195585,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -189126,11 +195635,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -189170,7 +195680,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -189182,7 +195694,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -189209,17 +195721,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -189240,12 +195752,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -189262,8 +195774,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -189297,7 +195809,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -189313,7 +195825,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -189326,19 +195843,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -189469,7 +195995,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -189482,7 +196008,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -189509,12 +196036,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -189524,14 +196052,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -189631,23 +196160,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -189717,7 +196251,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -189776,7 +196312,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -190004,13 +196544,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -190080,7 +196621,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -190095,19 +196637,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -190143,11 +196687,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -190187,7 +196732,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -190199,7 +196746,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -190226,17 +196773,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -190257,12 +196804,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -190279,8 +196826,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -190314,7 +196861,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -190330,7 +196877,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -190343,19 +196895,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -190486,7 +197047,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -190499,7 +197060,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -190526,12 +197088,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -190541,14 +197104,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -190648,23 +197212,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -190734,7 +197303,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -190793,7 +197364,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -191021,13 +197596,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -191097,7 +197673,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -191112,19 +197689,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -191160,11 +197739,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -191204,7 +197784,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -191216,7 +197798,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -191243,17 +197825,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -191274,12 +197856,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -191296,8 +197878,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -191331,7 +197913,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -191347,7 +197929,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -191360,19 +197947,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -191503,7 +198099,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -191516,7 +198112,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -191543,12 +198140,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -191558,14 +198156,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -191665,23 +198264,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -191751,7 +198355,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -191810,7 +198416,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -192038,13 +198648,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -192114,7 +198725,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -192129,19 +198741,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -192177,11 +198791,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -192221,7 +198836,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -192233,7 +198850,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -192260,17 +198877,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -192291,12 +198908,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -192313,8 +198930,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -192348,7 +198965,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -192364,7 +198981,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -192377,19 +198999,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -192520,7 +199151,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -192533,7 +199164,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -192560,12 +199192,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -192575,14 +199208,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -192682,23 +199316,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -192768,7 +199407,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -192827,7 +199468,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -193055,13 +199700,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -193131,7 +199777,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -193146,19 +199793,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -193194,11 +199843,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -193238,7 +199888,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -193250,7 +199902,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -193277,17 +199929,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -193308,12 +199960,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -193330,8 +199982,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -193365,7 +200017,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -193381,7 +200033,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -193394,19 +200051,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -193537,7 +200203,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -193550,7 +200216,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -193577,12 +200244,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -193592,14 +200260,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -193699,23 +200368,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -193785,7 +200459,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -193844,7 +200520,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -194072,13 +200752,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -194148,7 +200829,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -194163,19 +200845,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -194211,11 +200895,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -194255,7 +200940,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -194267,7 +200954,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -194294,17 +200981,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -194325,12 +201012,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -194347,8 +201034,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -194382,7 +201069,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -194398,7 +201085,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -194411,19 +201103,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -194554,7 +201255,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -194567,7 +201268,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -194594,12 +201296,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -194609,14 +201312,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -194716,23 +201420,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -194802,7 +201511,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -194861,7 +201572,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -195089,13 +201804,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -195165,7 +201881,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -195180,19 +201897,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -195228,11 +201947,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -195272,7 +201992,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -195284,7 +202006,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -195311,17 +202033,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -195342,12 +202064,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -195364,8 +202086,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -195399,7 +202121,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -195415,7 +202137,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -195428,19 +202155,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -195571,7 +202307,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -195584,7 +202320,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -195611,12 +202348,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -195626,14 +202364,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -195733,23 +202472,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -195819,7 +202563,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -195878,7 +202624,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -196106,13 +202856,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -196182,7 +202933,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -196197,19 +202949,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -196245,11 +202999,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -196289,7 +203044,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -196301,7 +203058,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -196328,17 +203085,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -196359,12 +203116,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -196381,8 +203138,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -196416,7 +203173,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -196432,7 +203189,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -196445,19 +203207,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -196588,7 +203359,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -196601,7 +203372,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -196628,12 +203400,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -196643,14 +203416,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -196750,23 +203524,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -196836,7 +203615,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -196895,7 +203676,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -197123,13 +203908,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -197199,7 +203985,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -197214,19 +204001,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -197262,11 +204051,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -197306,7 +204096,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -197318,7 +204110,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -197345,17 +204137,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -197376,12 +204168,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -197398,8 +204190,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -197433,7 +204225,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -197449,7 +204241,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -197462,19 +204259,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -197605,7 +204411,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -197618,7 +204424,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -197645,12 +204452,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -197660,14 +204468,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -197767,23 +204576,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -197853,7 +204667,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -197912,7 +204728,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -198140,13 +204960,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -198216,7 +205037,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -198231,19 +205053,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -198279,11 +205103,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -198323,7 +205148,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -198335,7 +205162,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -198362,17 +205189,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -198393,12 +205220,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -198415,8 +205242,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -198450,7 +205277,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -198466,7 +205293,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -198479,19 +205311,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -198622,7 +205463,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -198635,7 +205476,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -198662,12 +205504,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -198677,14 +205520,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -198784,23 +205628,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -198870,7 +205719,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -198929,7 +205780,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -199157,13 +206012,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -199233,7 +206089,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -199248,19 +206105,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -199296,11 +206155,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -199340,7 +206200,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -199352,7 +206214,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -199379,17 +206241,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -199410,12 +206272,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -199432,8 +206294,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -199467,7 +206329,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -199483,7 +206345,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -199496,19 +206363,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -199639,7 +206515,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -199652,7 +206528,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -199679,12 +206556,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -199694,14 +206572,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -199801,23 +206680,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -199887,7 +206771,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -199946,7 +206832,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -200174,13 +207064,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -200250,7 +207141,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -200265,19 +207157,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -200313,11 +207207,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -200357,7 +207252,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -200369,7 +207266,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -200396,17 +207293,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -200427,12 +207324,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -200449,8 +207346,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -200484,7 +207381,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -200500,7 +207397,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -200513,19 +207415,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -200656,7 +207567,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -200669,7 +207580,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -200696,12 +207608,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -200711,14 +207624,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -200818,23 +207732,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -200904,7 +207823,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -200963,7 +207884,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -201191,13 +208116,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -201267,7 +208193,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -201282,19 +208209,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -201330,11 +208259,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -201374,7 +208304,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -201386,7 +208318,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -201413,17 +208345,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -201444,12 +208376,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -201466,8 +208398,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -201501,7 +208433,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -201517,7 +208449,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -201530,19 +208467,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -201673,7 +208619,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -201686,7 +208632,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -201713,12 +208660,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -201728,14 +208676,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -201835,23 +208784,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -201921,7 +208875,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -201980,7 +208936,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -202208,13 +209168,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -202284,7 +209245,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -202299,19 +209261,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -202347,11 +209311,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -202391,7 +209356,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -202403,7 +209370,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -202430,17 +209397,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -202461,12 +209428,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -202483,8 +209450,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -202518,7 +209485,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -202534,7 +209501,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -202547,19 +209519,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -202690,7 +209671,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -202703,7 +209684,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -202730,12 +209712,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -202745,14 +209728,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -202852,23 +209836,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -202938,7 +209927,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -202997,7 +209988,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -203225,13 +210220,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -203301,7 +210297,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -203316,19 +210313,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -203364,11 +210363,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -203408,7 +210408,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -203420,7 +210422,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -203447,17 +210449,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -203478,12 +210480,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -203500,8 +210502,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -203535,7 +210537,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -203551,7 +210553,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -203564,19 +210571,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -203707,7 +210723,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -203720,7 +210736,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -203747,12 +210764,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -203762,14 +210780,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -203869,23 +210888,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -203955,7 +210979,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -204014,7 +211040,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -204242,13 +211272,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -204318,7 +211349,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -204333,19 +211365,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -204381,11 +211415,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -204425,7 +211460,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -204437,7 +211474,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -204464,17 +211501,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -204495,12 +211532,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -204517,8 +211554,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -204552,7 +211589,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -204568,7 +211605,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -204581,19 +211623,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -204724,7 +211775,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -204737,7 +211788,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -204764,12 +211816,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -204779,14 +211832,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -204886,23 +211940,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -204972,7 +212031,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -205031,7 +212092,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -205259,13 +212324,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -205335,7 +212401,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -205350,19 +212417,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -205398,11 +212467,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -205442,7 +212512,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -205454,7 +212526,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -205481,17 +212553,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -205512,12 +212584,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -205534,8 +212606,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -205569,7 +212641,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -205585,7 +212657,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -205598,19 +212675,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -205741,7 +212827,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -205754,7 +212840,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -205781,12 +212868,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -205796,14 +212884,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -205903,23 +212992,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -205989,7 +213083,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -206048,7 +213144,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -206276,13 +213376,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -206352,7 +213453,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -206367,19 +213469,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -206415,11 +213519,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -206459,7 +213564,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -206471,7 +213578,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -206498,17 +213605,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -206529,12 +213636,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -206551,8 +213658,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -206586,7 +213693,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -206602,7 +213709,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -206615,19 +213727,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -206758,7 +213879,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -206771,7 +213892,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -206798,12 +213920,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -206813,14 +213936,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -206920,23 +214044,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -207006,7 +214135,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -207065,7 +214196,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -207293,13 +214428,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -207369,7 +214505,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -207384,19 +214521,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -207432,11 +214571,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -207476,7 +214616,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -207488,7 +214630,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -207515,17 +214657,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -207546,12 +214688,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -207568,8 +214710,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -207603,7 +214745,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -207619,7 +214761,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -207632,19 +214779,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -207775,7 +214931,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -207788,7 +214944,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -207815,12 +214972,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -207830,14 +214988,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -207937,23 +215096,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -208023,7 +215187,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -208082,7 +215248,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -208310,13 +215480,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -208386,7 +215557,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -208401,19 +215573,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -208449,11 +215623,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -208493,7 +215668,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -208505,7 +215682,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -208532,17 +215709,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -208563,12 +215740,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -208585,8 +215762,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -208620,7 +215797,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -208636,7 +215813,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -208649,19 +215831,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -208792,7 +215983,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -208805,7 +215996,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -208832,12 +216024,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -208847,14 +216040,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -208954,23 +216148,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -209040,7 +216239,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -209099,7 +216300,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -209327,13 +216532,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -209403,7 +216609,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -209418,19 +216625,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -209466,11 +216675,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -209510,7 +216720,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -209522,7 +216734,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -209549,17 +216761,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -209580,12 +216792,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -209602,8 +216814,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -209637,7 +216849,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -209653,7 +216865,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -209666,19 +216883,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -209809,7 +217035,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -209822,7 +217048,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -209849,12 +217076,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -209864,14 +217092,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -209971,23 +217200,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -210057,7 +217291,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -210116,7 +217352,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -210344,13 +217584,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -210420,7 +217661,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -210435,19 +217677,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -210483,11 +217727,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -210527,7 +217772,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -210539,7 +217786,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -210566,17 +217813,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -210597,12 +217844,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -210619,8 +217866,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -210654,7 +217901,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -210670,7 +217917,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -210683,19 +217935,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -210826,7 +218087,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -210839,7 +218100,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -210866,12 +218128,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -210881,14 +218144,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -210988,23 +218252,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -211074,7 +218343,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -211133,7 +218404,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -211361,13 +218636,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -211437,7 +218713,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -211452,19 +218729,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -211500,11 +218779,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -211544,7 +218824,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -211556,7 +218838,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -211583,17 +218865,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -211614,12 +218896,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -211636,8 +218918,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -211671,7 +218953,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -211687,7 +218969,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -211700,19 +218987,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -211843,7 +219139,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -211856,7 +219152,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -211883,12 +219180,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -211898,14 +219196,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -212005,23 +219304,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -212091,7 +219395,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -212150,7 +219456,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -212378,13 +219688,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -212454,7 +219765,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -212469,19 +219781,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -212517,11 +219831,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -212561,7 +219876,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -212573,7 +219890,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -212600,17 +219917,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -212631,12 +219948,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -212653,8 +219970,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -212688,7 +220005,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -212704,7 +220021,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -212717,19 +220039,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -212860,7 +220191,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -212873,7 +220204,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -212900,12 +220232,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -212915,14 +220248,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -213022,23 +220356,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -213108,7 +220447,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -213167,7 +220508,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -213395,13 +220740,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -213471,7 +220817,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -213486,19 +220833,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -213534,11 +220883,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -213578,7 +220928,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -213590,7 +220942,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -213617,17 +220969,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -213648,12 +221000,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -213670,8 +221022,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -213705,7 +221057,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -213721,7 +221073,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -213734,19 +221091,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -213877,7 +221243,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -213890,7 +221256,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -213917,12 +221284,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -213932,14 +221300,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -214039,23 +221408,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -214125,7 +221499,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -214184,7 +221560,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -214412,13 +221792,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -214488,7 +221869,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -214503,19 +221885,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -214551,11 +221935,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -214595,7 +221980,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -214607,7 +221994,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -214634,17 +222021,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -214665,12 +222052,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -214687,8 +222074,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -214722,7 +222109,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -214738,7 +222125,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -214751,19 +222143,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -214894,7 +222295,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -214907,7 +222308,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -214934,12 +222336,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -214949,14 +222352,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -215056,23 +222460,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -215142,7 +222551,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -215201,7 +222612,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -215429,13 +222844,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -215505,7 +222921,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -215520,19 +222937,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -215568,11 +222987,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -215612,7 +223032,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -215624,7 +223046,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -215651,17 +223073,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -215682,12 +223104,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -215704,8 +223126,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -215739,7 +223161,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -215755,7 +223177,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -215768,19 +223195,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -215911,7 +223347,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -215924,7 +223360,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -215951,12 +223388,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -215966,14 +223404,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -216073,23 +223512,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -216159,7 +223603,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -216218,7 +223664,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -216446,13 +223896,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -216522,7 +223973,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -216537,19 +223989,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -216585,11 +224039,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -216629,7 +224084,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -216641,7 +224098,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -216668,17 +224125,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -216699,12 +224156,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -216721,8 +224178,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -216756,7 +224213,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -216772,7 +224229,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -216785,19 +224247,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -216928,7 +224399,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -216941,7 +224412,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -216968,12 +224440,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -216983,14 +224456,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -217090,23 +224564,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -217176,7 +224655,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -217235,7 +224716,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -217463,13 +224948,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -217539,7 +225025,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -217554,19 +225041,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -217602,11 +225091,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -217646,7 +225136,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -217658,7 +225150,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -217685,17 +225177,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -217716,12 +225208,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -217738,8 +225230,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -217773,7 +225265,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -217789,7 +225281,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -217802,19 +225299,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -217945,7 +225451,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -217958,7 +225464,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -217985,12 +225492,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -218000,14 +225508,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -218107,23 +225616,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -218193,7 +225707,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -218252,7 +225768,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -218480,13 +226000,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -218556,7 +226077,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -218571,19 +226093,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -218619,11 +226143,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -218663,7 +226188,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -218675,7 +226202,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -218702,17 +226229,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -218733,12 +226260,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -218755,8 +226282,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -218790,7 +226317,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -218806,7 +226333,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -218819,19 +226351,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -218962,7 +226503,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -218975,7 +226516,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -219002,12 +226544,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -219017,14 +226560,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -219124,23 +226668,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -219210,7 +226759,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -219269,7 +226820,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -219497,13 +227052,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -219573,7 +227129,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -219588,19 +227145,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -219636,11 +227195,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -219680,7 +227240,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -219692,7 +227254,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -219719,17 +227281,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -219750,12 +227312,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -219772,8 +227334,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -219807,7 +227369,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -219823,7 +227385,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -219836,19 +227403,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -219979,7 +227555,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -219992,7 +227568,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -220019,12 +227596,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -220034,14 +227612,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -220141,23 +227720,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -220227,7 +227811,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -220286,7 +227872,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -220514,13 +228104,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -220590,7 +228181,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -220605,19 +228197,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -220653,11 +228247,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -220697,7 +228292,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -220709,7 +228306,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -220736,17 +228333,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -220767,12 +228364,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -220789,8 +228386,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -220824,7 +228421,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -220840,7 +228437,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -220853,19 +228455,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -220996,7 +228607,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -221009,7 +228620,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -221036,12 +228648,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -221051,14 +228664,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -221158,23 +228772,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -221244,7 +228863,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -221303,7 +228924,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -221531,13 +229156,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -221607,7 +229233,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -221622,19 +229249,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -221670,11 +229299,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -221714,7 +229344,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -221726,7 +229358,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -221753,17 +229385,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -221784,12 +229416,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -221806,8 +229438,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -221841,7 +229473,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -221857,7 +229489,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -221870,19 +229507,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -222013,7 +229659,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -222026,7 +229672,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -222053,12 +229700,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -222068,14 +229716,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -222175,23 +229824,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -222261,7 +229915,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -222320,7 +229976,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -222548,13 +230208,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -222624,7 +230285,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -222639,19 +230301,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -222687,11 +230351,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -222731,7 +230396,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -222743,7 +230410,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -222770,17 +230437,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -222801,12 +230468,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -222823,8 +230490,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -222858,7 +230525,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -222874,7 +230541,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -222887,19 +230559,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -223030,7 +230711,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -223043,7 +230724,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -223070,12 +230752,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -223085,14 +230768,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -223192,23 +230876,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -223278,7 +230967,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -223337,7 +231028,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -223565,13 +231260,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -223641,7 +231337,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -223656,19 +231353,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -223704,11 +231403,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -223748,7 +231448,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -223760,7 +231462,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -223787,17 +231489,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -223818,12 +231520,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -223840,8 +231542,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -223875,7 +231577,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -223891,7 +231593,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -223904,19 +231611,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -224047,7 +231763,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -224060,7 +231776,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -224087,12 +231804,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -224102,14 +231820,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -224209,23 +231928,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -224295,7 +232019,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -224354,7 +232080,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -224582,13 +232312,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -224658,7 +232389,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -224673,19 +232405,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -224721,11 +232455,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -224765,7 +232500,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -224777,7 +232514,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -224804,17 +232541,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -224835,12 +232572,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -224857,8 +232594,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -224892,7 +232629,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -224908,7 +232645,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -224921,19 +232663,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -225064,7 +232815,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -225077,7 +232828,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -225104,12 +232856,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -225119,14 +232872,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -225226,23 +232980,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -225312,7 +233071,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -225371,7 +233132,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -225599,13 +233364,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -225675,7 +233441,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -225690,19 +233457,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -225738,11 +233507,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -225782,7 +233552,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -225794,7 +233566,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -225821,17 +233593,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -225852,12 +233624,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -225874,8 +233646,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -225909,7 +233681,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -225925,7 +233697,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -225938,19 +233715,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -226081,7 +233867,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -226094,7 +233880,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -226121,12 +233908,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -226136,14 +233924,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -226243,23 +234032,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -226329,7 +234123,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -226388,7 +234184,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -226616,13 +234416,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -226692,7 +234493,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -226707,19 +234509,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -226755,11 +234559,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -226799,7 +234604,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -226811,7 +234618,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -226838,17 +234645,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -226869,12 +234676,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -226891,8 +234698,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -226926,7 +234733,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -226942,7 +234749,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -226955,19 +234767,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -227098,7 +234919,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -227111,7 +234932,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -227138,12 +234960,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -227153,14 +234976,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -227260,23 +235084,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -227346,7 +235175,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -227405,7 +235236,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -227633,13 +235468,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -227709,7 +235545,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -227724,19 +235561,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -227772,11 +235611,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -227816,7 +235656,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -227828,7 +235670,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -227855,17 +235697,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -227886,12 +235728,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -227908,8 +235750,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -227943,7 +235785,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -227959,7 +235801,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -227972,19 +235819,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -228115,7 +235971,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -228128,7 +235984,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -228155,12 +236012,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -228170,14 +236028,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -228277,23 +236136,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -228363,7 +236227,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -228422,7 +236288,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -228650,13 +236520,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -228726,7 +236597,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -228741,19 +236613,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -228789,11 +236663,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -228833,7 +236708,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -228845,7 +236722,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -228872,17 +236749,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -228903,12 +236780,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -228925,8 +236802,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -228960,7 +236837,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -228976,7 +236853,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -228989,19 +236871,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -229132,7 +237023,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -229145,7 +237036,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -229172,12 +237064,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -229187,14 +237080,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -229294,23 +237188,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -229380,7 +237279,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -229439,7 +237340,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -229667,13 +237572,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -229743,7 +237649,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -229758,19 +237665,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -229806,11 +237715,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -229850,7 +237760,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -229862,7 +237774,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -229889,17 +237801,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -229920,12 +237832,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -229942,8 +237854,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -229977,7 +237889,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -229993,7 +237905,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -230006,19 +237923,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -230149,7 +238075,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -230162,7 +238088,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -230189,12 +238116,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -230204,14 +238132,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -230311,23 +238240,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -230397,7 +238331,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -230456,7 +238392,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -230684,13 +238624,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -230760,7 +238701,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -230775,19 +238717,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -230823,11 +238767,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -230867,7 +238812,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -230879,7 +238826,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -230906,17 +238853,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -230937,12 +238884,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -230959,8 +238906,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -230994,7 +238941,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -231010,7 +238957,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -231023,19 +238975,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -231166,7 +239127,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -231179,7 +239140,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -231206,12 +239168,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -231221,14 +239184,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -231328,23 +239292,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -231414,7 +239383,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -231473,7 +239444,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -231701,13 +239676,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -231777,7 +239753,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -231792,19 +239769,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -231840,11 +239819,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -231884,7 +239864,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -231896,7 +239878,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -231923,17 +239905,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -231954,12 +239936,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -231976,8 +239958,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -232011,7 +239993,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -232027,7 +240009,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -232040,19 +240027,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -232183,7 +240179,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -232196,7 +240192,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -232223,12 +240220,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -232238,14 +240236,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -232345,23 +240344,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -232431,7 +240435,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -232490,7 +240496,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -232718,13 +240728,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -232794,7 +240805,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -232809,19 +240821,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -232857,11 +240871,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -232901,7 +240916,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -232913,7 +240930,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -232940,17 +240957,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -232971,12 +240988,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -232993,8 +241010,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -233028,7 +241045,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -233044,7 +241061,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -233057,19 +241079,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -233200,7 +241231,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -233213,7 +241244,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -233240,12 +241272,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -233255,14 +241288,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -233362,23 +241396,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -233448,7 +241487,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -233507,7 +241548,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -233735,13 +241780,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -233811,7 +241857,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -233826,19 +241873,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -233874,11 +241923,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -233918,7 +241968,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -233930,7 +241982,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -233957,17 +242009,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -233988,12 +242040,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -234010,8 +242062,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -234045,7 +242097,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -234061,7 +242113,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -234074,19 +242131,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -234217,7 +242283,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -234230,7 +242296,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -234257,12 +242324,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -234272,14 +242340,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -234379,23 +242448,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -234465,7 +242539,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -234524,7 +242600,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -234752,13 +242832,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -234828,7 +242909,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -234843,19 +242925,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -234891,11 +242975,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -234935,7 +243020,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -234947,7 +243034,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -234974,17 +243061,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -235005,12 +243092,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -235027,8 +243114,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -235062,7 +243149,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -235078,7 +243165,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -235091,19 +243183,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -235234,7 +243335,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -235247,7 +243348,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -235274,12 +243376,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -235289,14 +243392,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -235396,23 +243500,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -235482,7 +243591,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -235541,7 +243652,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -235769,13 +243884,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -235845,7 +243961,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -235860,19 +243977,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -235908,11 +244027,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -235952,7 +244072,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -235964,7 +244086,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -235991,17 +244113,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -236022,12 +244144,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -236044,8 +244166,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -236079,7 +244201,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -236095,7 +244217,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -236108,19 +244235,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -236251,7 +244387,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -236264,7 +244400,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -236291,12 +244428,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -236306,14 +244444,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -236413,23 +244552,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -236499,7 +244643,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -236558,7 +244704,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -236786,13 +244936,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -236862,7 +245013,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -236877,19 +245029,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -236925,11 +245079,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -236969,7 +245124,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -236981,7 +245138,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -237008,17 +245165,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -237039,12 +245196,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -237061,8 +245218,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -237096,7 +245253,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -237112,7 +245269,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -237125,19 +245287,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -237268,7 +245439,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -237281,7 +245452,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -237308,12 +245480,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -237323,14 +245496,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -237430,23 +245604,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -237516,7 +245695,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -237575,7 +245756,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -237803,13 +245988,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -237879,7 +246065,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -237894,19 +246081,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -237942,11 +246131,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -237986,7 +246176,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -237998,7 +246190,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -238025,17 +246217,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -238056,12 +246248,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -238078,8 +246270,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -238113,7 +246305,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -238129,7 +246321,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -238142,19 +246339,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -238285,7 +246491,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -238298,7 +246504,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -238325,12 +246532,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -238340,14 +246548,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -238447,23 +246656,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -238533,7 +246747,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -238592,7 +246808,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -238820,13 +247040,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -238896,7 +247117,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -238911,19 +247133,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -238959,11 +247183,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -239003,7 +247228,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -239015,7 +247242,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -239042,17 +247269,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -239073,12 +247300,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -239095,8 +247322,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -239130,7 +247357,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -239146,7 +247373,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -239159,19 +247391,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -239302,7 +247543,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -239315,7 +247556,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -239342,12 +247584,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -239357,14 +247600,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -239464,23 +247708,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -239550,7 +247799,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -239609,7 +247860,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -239837,13 +248092,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -239913,7 +248169,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -239928,19 +248185,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -239976,11 +248235,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -240020,7 +248280,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -240032,7 +248294,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -240059,17 +248321,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -240090,12 +248352,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -240112,8 +248374,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -240147,7 +248409,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -240163,7 +248425,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -240176,19 +248443,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -240319,7 +248595,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -240332,7 +248608,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -240359,12 +248636,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -240374,14 +248652,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -240481,23 +248760,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -240567,7 +248851,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -240626,7 +248912,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -240854,13 +249144,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -240930,7 +249221,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -240945,19 +249237,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -240993,11 +249287,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -241037,7 +249332,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -241049,7 +249346,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -241076,17 +249373,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -241107,12 +249404,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -241129,8 +249426,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -241164,7 +249461,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -241180,7 +249477,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -241193,19 +249495,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -241336,7 +249647,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -241349,7 +249660,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -241376,12 +249688,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -241391,14 +249704,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -241498,23 +249812,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -241584,7 +249903,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -241643,7 +249964,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -241871,13 +250196,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -241947,7 +250273,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -241962,19 +250289,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -242010,11 +250339,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -242054,7 +250384,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -242066,7 +250398,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -242093,17 +250425,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -242124,12 +250456,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -242146,8 +250478,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -242181,7 +250513,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -242197,7 +250529,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -242210,19 +250547,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -242353,7 +250699,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -242366,7 +250712,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -242393,12 +250740,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -242408,14 +250756,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -242515,23 +250864,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -242601,7 +250955,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -242660,7 +251016,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -242888,13 +251248,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -242964,7 +251325,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -242979,19 +251341,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -243027,11 +251391,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -243071,7 +251436,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -243083,7 +251450,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -243110,17 +251477,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -243141,12 +251508,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -243163,8 +251530,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -243198,7 +251565,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -243214,7 +251581,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -243227,19 +251599,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -243370,7 +251751,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -243383,7 +251764,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -243410,12 +251792,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -243425,14 +251808,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -243532,23 +251916,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -243618,7 +252007,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -243677,7 +252068,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -243905,13 +252300,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -243981,7 +252377,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -243996,19 +252393,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -244044,11 +252443,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -244088,7 +252488,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -244100,7 +252502,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -244127,17 +252529,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -244158,12 +252560,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -244180,8 +252582,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -244215,7 +252617,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -244231,7 +252633,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -244244,19 +252651,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -244387,7 +252803,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -244400,7 +252816,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -244427,12 +252844,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -244442,14 +252860,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -244549,23 +252968,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -244635,7 +253059,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -244694,7 +253120,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -244922,13 +253352,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -244998,7 +253429,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -245013,19 +253445,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -245061,11 +253495,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -245105,7 +253540,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -245117,7 +253554,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -245144,17 +253581,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -245175,12 +253612,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -245197,8 +253634,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -245232,7 +253669,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -245248,7 +253685,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -245261,19 +253703,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -245404,7 +253855,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -245417,7 +253868,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -245444,12 +253896,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -245459,14 +253912,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -245566,23 +254020,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -245652,7 +254111,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -245711,7 +254172,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -245939,13 +254404,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -246015,7 +254481,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -246030,19 +254497,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -246078,11 +254547,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -246122,7 +254592,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -246134,7 +254606,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -246161,17 +254633,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -246192,12 +254664,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -246214,8 +254686,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -246249,7 +254721,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -246265,7 +254737,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -246278,19 +254755,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -246421,7 +254907,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -246434,7 +254920,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -246461,12 +254948,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -246476,14 +254964,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -246583,23 +255072,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -246669,7 +255163,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -246728,7 +255224,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -246956,13 +255456,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -247032,7 +255533,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -247047,19 +255549,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -247095,11 +255599,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -247139,7 +255644,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -247151,7 +255658,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -247178,17 +255685,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -247209,12 +255716,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -247231,8 +255738,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -247266,7 +255773,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -247282,7 +255789,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -247295,19 +255807,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -247438,7 +255959,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -247451,7 +255972,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -247478,12 +256000,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -247493,14 +256016,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -247600,23 +256124,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -247686,7 +256215,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -247745,7 +256276,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -247973,13 +256508,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -248049,7 +256585,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -248064,19 +256601,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -248112,11 +256651,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -248156,7 +256696,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -248168,7 +256710,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -248195,17 +256737,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -248226,12 +256768,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -248248,8 +256790,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -248283,7 +256825,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -248299,7 +256841,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -248312,19 +256859,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -248455,7 +257011,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -248468,7 +257024,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -248495,12 +257052,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -248510,14 +257068,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -248617,23 +257176,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -248703,7 +257267,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -248762,7 +257328,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -248990,13 +257560,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -249066,7 +257637,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -249081,19 +257653,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -249129,11 +257703,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -249173,7 +257748,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -249185,7 +257762,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -249212,17 +257789,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -249243,12 +257820,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -249265,8 +257842,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -249300,7 +257877,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -249316,7 +257893,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -249329,19 +257911,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -249472,7 +258063,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -249485,7 +258076,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -249512,12 +258104,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -249527,14 +258120,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -249634,23 +258228,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -249720,7 +258319,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -249779,7 +258380,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -250007,13 +258612,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -250083,7 +258689,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -250098,19 +258705,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -250146,11 +258755,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -250190,7 +258800,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -250202,7 +258814,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -250229,17 +258841,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -250260,12 +258872,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -250282,8 +258894,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -250317,7 +258929,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -250333,7 +258945,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -250346,19 +258963,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -250489,7 +259115,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -250502,7 +259128,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -250529,12 +259156,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -250544,14 +259172,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -250651,23 +259280,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -250737,7 +259371,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -250796,7 +259432,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -251024,13 +259664,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -251100,7 +259741,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -251115,19 +259757,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -251163,11 +259807,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -251207,7 +259852,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -251219,7 +259866,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -251246,17 +259893,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -251277,12 +259924,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -251299,8 +259946,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -251334,7 +259981,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -251350,7 +259997,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -251363,19 +260015,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -251506,7 +260167,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -251519,7 +260180,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -251546,12 +260208,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -251561,14 +260224,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -251668,23 +260332,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -251754,7 +260423,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -251813,7 +260484,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -252041,13 +260716,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -252117,7 +260793,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -252132,19 +260809,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -252180,11 +260859,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -252224,7 +260904,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -252236,7 +260918,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -252263,17 +260945,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -252294,12 +260976,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -252316,8 +260998,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -252351,7 +261033,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -252367,7 +261049,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -252380,19 +261067,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -252523,7 +261219,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -252536,7 +261232,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -252563,12 +261260,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -252578,14 +261276,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -252685,23 +261384,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -252771,7 +261475,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -252830,7 +261536,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -253058,13 +261768,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -253134,7 +261845,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -253149,19 +261861,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -253197,11 +261911,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -253241,7 +261956,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -253253,7 +261970,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -253280,17 +261997,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -253311,12 +262028,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -253333,8 +262050,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -253368,7 +262085,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -253384,7 +262101,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -253397,19 +262119,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -253540,7 +262271,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -253553,7 +262284,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -253580,12 +262312,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -253595,14 +262328,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -253702,23 +262436,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -253788,7 +262527,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -253847,7 +262588,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -254075,13 +262820,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -254151,7 +262897,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -254166,19 +262913,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -254214,11 +262963,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -254258,7 +263008,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -254270,7 +263022,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -254297,17 +263049,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -254328,12 +263080,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -254350,8 +263102,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -254385,7 +263137,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -254401,7 +263153,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -254414,19 +263171,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -254557,7 +263323,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -254570,7 +263336,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -254597,12 +263364,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -254612,14 +263380,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -254719,23 +263488,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -254805,7 +263579,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -254864,7 +263640,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -255092,13 +263872,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -255168,7 +263949,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -255183,19 +263965,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -255231,11 +264015,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -255275,7 +264060,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -255287,7 +264074,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -255314,17 +264101,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -255345,12 +264132,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -255367,8 +264154,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -255402,7 +264189,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -255418,7 +264205,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -255431,19 +264223,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -255574,7 +264375,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -255587,7 +264388,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -255614,12 +264416,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -255629,14 +264432,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -255736,23 +264540,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -255822,7 +264631,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -255881,7 +264692,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -256109,13 +264924,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -256185,7 +265001,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -256200,19 +265017,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -256248,11 +265067,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -256292,7 +265112,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -256304,7 +265126,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -256331,17 +265153,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -256362,12 +265184,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -256384,8 +265206,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -256419,7 +265241,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -256435,7 +265257,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -256448,19 +265275,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -256591,7 +265427,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -256604,7 +265440,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -256631,12 +265468,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -256646,14 +265484,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -256753,23 +265592,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -256839,7 +265683,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -256898,7 +265744,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -257126,13 +265976,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -257202,7 +266053,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -257217,19 +266069,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -257265,11 +266119,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -257309,7 +266164,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -257321,7 +266178,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -257348,17 +266205,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -257379,12 +266236,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -257401,8 +266258,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -257436,7 +266293,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -257452,7 +266309,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -257465,19 +266327,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -257608,7 +266479,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -257621,7 +266492,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -257648,12 +266520,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -257663,14 +266536,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -257770,23 +266644,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -257856,7 +266735,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -257915,7 +266796,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -258143,13 +267028,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -258219,7 +267105,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -258234,19 +267121,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -258282,11 +267171,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -258326,7 +267216,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -258338,7 +267230,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -258365,17 +267257,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -258396,12 +267288,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -258418,8 +267310,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -258453,7 +267345,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -258469,7 +267361,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -258482,19 +267379,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -258625,7 +267531,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -258638,7 +267544,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -258665,12 +267572,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -258680,14 +267588,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -258787,23 +267696,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -258873,7 +267787,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -258932,7 +267848,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -259160,13 +268080,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -259236,7 +268157,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -259251,19 +268173,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -259299,11 +268223,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -259343,7 +268268,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -259355,7 +268282,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -259382,17 +268309,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -259413,12 +268340,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -259435,8 +268362,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -259470,7 +268397,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -259486,7 +268413,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -259499,19 +268431,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -259642,7 +268583,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -259655,7 +268596,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -259682,12 +268624,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -259697,14 +268640,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -259804,23 +268748,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -259890,7 +268839,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -259949,7 +268900,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -260177,13 +269132,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -260253,7 +269209,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -260268,19 +269225,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -260316,11 +269275,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -260360,7 +269320,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -260372,7 +269334,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -260399,17 +269361,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -260430,12 +269392,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -260452,8 +269414,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -260487,7 +269449,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -260503,7 +269465,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -260516,19 +269483,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -260659,7 +269635,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -260672,7 +269648,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -260699,12 +269676,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -260714,14 +269692,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -260821,23 +269800,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -260907,7 +269891,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -260966,7 +269952,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -261194,13 +270184,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -261270,7 +270261,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -261285,19 +270277,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -261333,11 +270327,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -261377,7 +270372,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -261389,7 +270386,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -261416,17 +270413,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -261447,12 +270444,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -261469,8 +270466,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -261504,7 +270501,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -261520,7 +270517,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -261533,19 +270535,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -261676,7 +270687,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -261689,7 +270700,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -261716,12 +270728,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -261731,14 +270744,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -261838,23 +270852,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -261924,7 +270943,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -261983,7 +271004,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -262211,13 +271236,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -262287,7 +271313,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -262302,19 +271329,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -262350,11 +271379,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -262394,7 +271424,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -262406,7 +271438,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -262433,17 +271465,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -262464,12 +271496,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -262486,8 +271518,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -262521,7 +271553,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -262537,7 +271569,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -262550,19 +271587,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -262693,7 +271739,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -262706,7 +271752,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -262733,12 +271780,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -262748,14 +271796,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -262855,23 +271904,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -262941,7 +271995,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -263000,7 +272056,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -263228,13 +272288,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -263304,7 +272365,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -263319,19 +272381,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -263367,11 +272431,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -263411,7 +272476,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -263423,7 +272490,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -263450,17 +272517,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -263481,12 +272548,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -263503,8 +272570,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -263538,7 +272605,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -263554,7 +272621,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -263567,19 +272639,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -263710,7 +272791,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -263723,7 +272804,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -263750,12 +272832,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -263765,14 +272848,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -263872,23 +272956,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -263958,7 +273047,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -264017,7 +273108,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -264245,13 +273340,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -264321,7 +273417,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -264336,19 +273433,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -264384,11 +273483,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -264428,7 +273528,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -264440,7 +273542,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -264467,17 +273569,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -264498,12 +273600,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -264520,8 +273622,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -264555,7 +273657,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -264571,7 +273673,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -264584,19 +273691,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -264727,7 +273843,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -264740,7 +273856,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -264767,12 +273884,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -264782,14 +273900,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -264889,23 +274008,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -264975,7 +274099,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -265034,7 +274160,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -265262,13 +274392,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -265338,7 +274469,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -265353,19 +274485,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -265401,11 +274535,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -265445,7 +274580,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -265457,7 +274594,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -265484,17 +274621,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -265515,12 +274652,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -265537,8 +274674,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -265572,7 +274709,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -265588,7 +274725,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -265601,19 +274743,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -265744,7 +274895,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -265757,7 +274908,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -265784,12 +274936,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -265799,14 +274952,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -265906,23 +275060,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -265992,7 +275151,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -266051,7 +275212,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -266279,13 +275444,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -266355,7 +275521,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -266370,19 +275537,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -266418,11 +275587,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -266462,7 +275632,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -266474,7 +275646,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -266501,17 +275673,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -266532,12 +275704,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -266554,8 +275726,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -266589,7 +275761,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -266605,7 +275777,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -266618,19 +275795,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -266761,7 +275947,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -266774,7 +275960,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -266801,12 +275988,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -266816,14 +276004,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -266923,23 +276112,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -267009,7 +276203,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -267068,7 +276264,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -267296,13 +276496,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -267372,7 +276573,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -267387,19 +276589,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -267435,11 +276639,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -267479,7 +276684,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -267491,7 +276698,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -267518,17 +276725,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -267549,12 +276756,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -267571,8 +276778,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -267606,7 +276813,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -267622,7 +276829,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -267635,19 +276847,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -267778,7 +276999,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -267791,7 +277012,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -267818,12 +277040,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -267833,14 +277056,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -267940,23 +277164,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -268026,7 +277255,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -268085,7 +277316,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -268313,13 +277548,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -268389,7 +277625,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -268404,19 +277641,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -268452,11 +277691,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -268496,7 +277736,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -268508,7 +277750,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -268535,17 +277777,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -268566,12 +277808,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -268588,8 +277830,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -268623,7 +277865,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -268639,7 +277881,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -268652,19 +277899,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -268795,7 +278051,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -268808,7 +278064,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -268835,12 +278092,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -268850,14 +278108,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -268957,23 +278216,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -269043,7 +278307,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -269102,7 +278368,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -269330,13 +278600,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -269406,7 +278677,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -269421,19 +278693,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -269469,11 +278743,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -269513,7 +278788,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -269525,7 +278802,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -269552,17 +278829,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -269583,12 +278860,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -269605,8 +278882,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -269640,7 +278917,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -269656,7 +278933,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -269669,19 +278951,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -269812,7 +279103,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -269825,7 +279116,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -269852,12 +279144,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -269867,14 +279160,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -269974,23 +279268,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -270060,7 +279359,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -270119,7 +279420,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -270347,13 +279652,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -270423,7 +279729,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -270438,19 +279745,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -270486,11 +279795,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -270530,7 +279840,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -270542,7 +279854,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -270569,17 +279881,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -270600,12 +279912,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -270622,8 +279934,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -270657,7 +279969,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -270673,7 +279985,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -270686,19 +280003,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -270829,7 +280155,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -270842,7 +280168,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -270869,12 +280196,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -270884,14 +280212,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -270991,23 +280320,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -271077,7 +280411,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -271136,7 +280472,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -271364,13 +280704,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -271440,7 +280781,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -271455,19 +280797,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -271503,11 +280847,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -271547,7 +280892,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -271559,7 +280906,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -271586,17 +280933,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -271617,12 +280964,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -271639,8 +280986,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -271674,7 +281021,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -271690,7 +281037,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -271703,19 +281055,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -271846,7 +281207,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -271859,7 +281220,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -271886,12 +281248,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -271901,14 +281264,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -272008,23 +281372,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -272094,7 +281463,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -272153,7 +281524,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -272381,13 +281756,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -272457,7 +281833,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -272472,19 +281849,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -272520,11 +281899,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -272564,7 +281944,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -272576,7 +281958,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -272603,17 +281985,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -272634,12 +282016,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -272656,8 +282038,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -272691,7 +282073,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -272707,7 +282089,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -272720,19 +282107,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -272863,7 +282259,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -272876,7 +282272,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -272903,12 +282300,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -272918,14 +282316,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -273025,23 +282424,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -273111,7 +282515,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -273170,7 +282576,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -273398,13 +282808,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -273474,7 +282885,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -273489,19 +282901,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -273537,11 +282951,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -273581,7 +282996,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -273593,7 +283010,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -273620,17 +283037,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -273651,12 +283068,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -273673,8 +283090,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -273708,7 +283125,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -273724,7 +283141,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -273737,19 +283159,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -273880,7 +283311,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -273893,7 +283324,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -273920,12 +283352,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -273935,14 +283368,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -274042,23 +283476,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -274128,7 +283567,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -274187,7 +283628,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -274415,13 +283860,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -274491,7 +283937,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -274506,19 +283953,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -274554,11 +284003,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -274598,7 +284048,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -274610,7 +284062,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -274637,17 +284089,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -274668,12 +284120,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -274690,8 +284142,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -274725,7 +284177,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -274741,7 +284193,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -274754,19 +284211,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -274897,7 +284363,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -274910,7 +284376,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -274937,12 +284404,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -274952,14 +284420,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -275059,23 +284528,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -275145,7 +284619,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -275204,7 +284680,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -275432,13 +284912,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -275508,7 +284989,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -275523,19 +285005,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -275571,11 +285055,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -275615,7 +285100,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -275627,7 +285114,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -275654,17 +285141,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -275685,12 +285172,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -275707,8 +285194,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -275742,7 +285229,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -275758,7 +285245,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -275771,19 +285263,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -275914,7 +285415,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -275927,7 +285428,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -275954,12 +285456,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -275969,14 +285472,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -276076,23 +285580,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -276162,7 +285671,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -276221,7 +285732,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -276449,13 +285964,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -276525,7 +286041,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -276540,19 +286057,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -276588,11 +286107,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -276632,7 +286152,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -276644,7 +286166,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -276671,17 +286193,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -276702,12 +286224,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -276724,8 +286246,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -276759,7 +286281,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -276775,7 +286297,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -276788,19 +286315,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -276931,7 +286467,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -276944,7 +286480,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -276971,12 +286508,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -276986,14 +286524,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -277093,23 +286632,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -277179,7 +286723,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -277238,7 +286784,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -277466,13 +287016,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -277542,7 +287093,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -277557,19 +287109,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -277605,11 +287159,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -277649,7 +287204,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -277661,7 +287218,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -277688,17 +287245,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -277719,12 +287276,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -277741,8 +287298,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -277776,7 +287333,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -277792,7 +287349,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -277805,19 +287367,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -277948,7 +287519,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -277961,7 +287532,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -277988,12 +287560,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -278003,14 +287576,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -278110,23 +287684,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -278196,7 +287775,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -278255,7 +287836,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -278483,13 +288068,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -278559,7 +288145,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -278574,19 +288161,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -278622,11 +288211,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -278666,7 +288256,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -278678,7 +288270,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -278705,17 +288297,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -278736,12 +288328,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -278758,8 +288350,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -278793,7 +288385,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -278809,7 +288401,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -278822,19 +288419,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -278965,7 +288571,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -278978,7 +288584,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -279005,12 +288612,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -279020,14 +288628,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -279127,23 +288736,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -279213,7 +288827,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -279272,7 +288888,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -279500,13 +289120,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -279576,7 +289197,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -279591,19 +289213,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -279639,11 +289263,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -279683,7 +289308,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -279695,7 +289322,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -279722,17 +289349,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -279753,12 +289380,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -279775,8 +289402,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -279810,7 +289437,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -279826,7 +289453,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -279839,19 +289471,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -279982,7 +289623,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -279995,7 +289636,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -280022,12 +289664,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -280037,14 +289680,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -280144,23 +289788,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -280230,7 +289879,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -280289,7 +289940,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -280517,13 +290172,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -280593,7 +290249,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -280608,19 +290265,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -280656,11 +290315,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -280700,7 +290360,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -280712,7 +290374,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -280739,17 +290401,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -280770,12 +290432,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -280792,8 +290454,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -280827,7 +290489,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -280843,7 +290505,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -280856,19 +290523,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -280999,7 +290675,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -281012,7 +290688,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -281039,12 +290716,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -281054,14 +290732,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -281161,23 +290840,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -281247,7 +290931,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -281306,7 +290992,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -281534,13 +291224,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -281610,7 +291301,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -281625,19 +291317,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -281673,11 +291367,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -281717,7 +291412,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -281729,7 +291426,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -281756,17 +291453,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -281787,12 +291484,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -281809,8 +291506,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -281844,7 +291541,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -281860,7 +291557,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -281873,19 +291575,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -282016,7 +291727,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -282029,7 +291740,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -282056,12 +291768,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -282071,14 +291784,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -282178,23 +291892,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -282264,7 +291983,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -282323,7 +292044,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -282551,13 +292276,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -282627,7 +292353,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -282642,19 +292369,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -282690,11 +292419,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -282734,7 +292464,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -282746,7 +292478,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -282773,17 +292505,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -282804,12 +292536,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -282826,8 +292558,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -282861,7 +292593,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -282877,7 +292609,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -282890,19 +292627,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -283033,7 +292779,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -283046,7 +292792,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -283073,12 +292820,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -283088,14 +292836,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -283195,23 +292944,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -283281,7 +293035,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -283340,7 +293096,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -283568,13 +293328,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -283644,7 +293405,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -283659,19 +293421,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -283707,11 +293471,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -283751,7 +293516,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -283763,7 +293530,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -283790,17 +293557,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -283821,12 +293588,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -283843,8 +293610,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -283878,7 +293645,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -283894,7 +293661,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -283907,19 +293679,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -284050,7 +293831,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -284063,7 +293844,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -284090,12 +293872,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -284105,14 +293888,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -284212,23 +293996,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -284298,7 +294087,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -284357,7 +294148,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -284585,13 +294380,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -284661,7 +294457,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -284676,19 +294473,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -284724,11 +294523,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -284768,7 +294568,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -284780,7 +294582,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -284807,17 +294609,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -284838,12 +294640,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -284860,8 +294662,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -284895,7 +294697,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -284911,7 +294713,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -284924,19 +294731,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -285067,7 +294883,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -285080,7 +294896,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -285107,12 +294924,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -285122,14 +294940,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -285229,23 +295048,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -285315,7 +295139,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -285374,7 +295200,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -285602,13 +295432,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -285678,7 +295509,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -285693,19 +295525,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -285741,11 +295575,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -285785,7 +295620,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -285797,7 +295634,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -285824,17 +295661,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -285855,12 +295692,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -285877,8 +295714,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -285912,7 +295749,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -285928,7 +295765,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -285941,19 +295783,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -286084,7 +295935,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -286097,7 +295948,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -286124,12 +295976,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -286139,14 +295992,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -286246,23 +296100,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -286332,7 +296191,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -286391,7 +296252,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -286619,13 +296484,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -286695,7 +296561,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -286710,19 +296577,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -286758,11 +296627,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -286802,7 +296672,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -286814,7 +296686,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -286841,17 +296713,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -286872,12 +296744,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -286894,8 +296766,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -286929,7 +296801,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -286945,7 +296817,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -286958,19 +296835,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -287101,7 +296987,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -287114,7 +297000,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -287141,12 +297028,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -287156,14 +297044,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -287263,23 +297152,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -287349,7 +297243,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -287408,7 +297304,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -287636,13 +297536,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -287712,7 +297613,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -287727,19 +297629,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -287775,11 +297679,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -287819,7 +297724,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -287831,7 +297738,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -287858,17 +297765,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -287889,12 +297796,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -287911,8 +297818,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -287946,7 +297853,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -287962,7 +297869,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -287975,19 +297887,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -288118,7 +298039,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -288131,7 +298052,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -288158,12 +298080,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -288173,14 +298096,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -288280,23 +298204,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -288366,7 +298295,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -288425,7 +298356,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -288653,13 +298588,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -288729,7 +298665,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -288744,19 +298681,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -288792,11 +298731,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -288836,7 +298776,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -288848,7 +298790,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -288875,17 +298817,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -288906,12 +298848,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -288928,8 +298870,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -288963,7 +298905,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -288979,7 +298921,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -288992,19 +298939,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -289135,7 +299091,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -289148,7 +299104,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -289175,12 +299132,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -289190,14 +299148,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -289297,23 +299256,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -289383,7 +299347,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -289442,7 +299408,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -289670,13 +299640,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -289746,7 +299717,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -289761,19 +299733,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -289809,11 +299783,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -289853,7 +299828,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -289865,7 +299842,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -289892,17 +299869,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -289923,12 +299900,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -289945,8 +299922,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -289980,7 +299957,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -289996,7 +299973,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -290009,19 +299991,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -290152,7 +300143,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -290165,7 +300156,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -290192,12 +300184,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -290207,14 +300200,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -290314,23 +300308,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -290400,7 +300399,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -290459,7 +300460,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -290687,13 +300692,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -290763,7 +300769,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -290778,19 +300785,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -290826,11 +300835,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -290870,7 +300880,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -290882,7 +300894,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -290909,17 +300921,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -290940,12 +300952,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -290962,8 +300974,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -290997,7 +301009,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -291013,7 +301025,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -291026,19 +301043,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -291169,7 +301195,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -291182,7 +301208,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -291209,12 +301236,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -291224,14 +301252,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -291331,23 +301360,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -291417,7 +301451,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -291476,7 +301512,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -291704,13 +301744,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -291780,7 +301821,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -291795,19 +301837,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -291843,11 +301887,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -291887,7 +301932,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -291899,7 +301946,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -291926,17 +301973,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -291957,12 +302004,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -291979,8 +302026,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -292014,7 +302061,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -292030,7 +302077,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -292043,19 +302095,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -292186,7 +302247,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -292199,7 +302260,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -292226,12 +302288,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -292241,14 +302304,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -292348,23 +302412,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -292434,7 +302503,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -292493,7 +302564,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -292721,13 +302796,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -292797,7 +302873,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -292812,19 +302889,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -292860,11 +302939,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -292904,7 +302984,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -292916,7 +302998,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -292943,17 +303025,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -292974,12 +303056,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -292996,8 +303078,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -293031,7 +303113,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -293047,7 +303129,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -293060,19 +303147,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -293203,7 +303299,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -293216,7 +303312,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -293243,12 +303340,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -293258,14 +303356,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -293365,23 +303464,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -293451,7 +303555,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -293510,7 +303616,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -293738,13 +303848,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -293814,7 +303925,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -293829,19 +303941,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -293877,11 +303991,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -293921,7 +304036,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -293933,7 +304050,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -293960,17 +304077,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -293991,12 +304108,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -294013,8 +304130,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -294048,7 +304165,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -294064,7 +304181,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -294077,19 +304199,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -294220,7 +304351,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -294233,7 +304364,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -294260,12 +304392,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -294275,14 +304408,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -294382,23 +304516,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -294468,7 +304607,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -294527,7 +304668,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -294755,13 +304900,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -294831,7 +304977,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -294846,19 +304993,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -294894,11 +305043,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -294938,7 +305088,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -294950,7 +305102,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -294977,17 +305129,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -295008,12 +305160,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -295030,8 +305182,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -295065,7 +305217,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -295081,7 +305233,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -295094,19 +305251,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -295237,7 +305403,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -295250,7 +305416,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -295277,12 +305444,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -295292,14 +305460,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -295399,23 +305568,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -295485,7 +305659,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -295544,7 +305720,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -295772,13 +305952,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -295848,7 +306029,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -295863,19 +306045,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -295911,11 +306095,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -295955,7 +306140,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -295967,7 +306154,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -295994,17 +306181,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -296025,12 +306212,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -296047,8 +306234,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -296082,7 +306269,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -296098,7 +306285,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -296111,19 +306303,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -296254,7 +306455,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -296267,7 +306468,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -296294,12 +306496,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -296309,14 +306512,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -296416,23 +306620,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -296502,7 +306711,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -296561,7 +306772,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -296789,13 +307004,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -296865,7 +307081,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -296880,19 +307097,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -296928,11 +307147,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -296972,7 +307192,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -296984,7 +307206,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -297011,17 +307233,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -297042,12 +307264,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -297064,8 +307286,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -297099,7 +307321,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -297115,7 +307337,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -297128,19 +307355,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -297271,7 +307507,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -297284,7 +307520,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -297311,12 +307548,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -297326,14 +307564,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -297433,23 +307672,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -297519,7 +307763,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -297578,7 +307824,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -297806,13 +308056,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -297882,7 +308133,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -297897,19 +308149,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -297945,11 +308199,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -297989,7 +308244,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -298001,7 +308258,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -298028,17 +308285,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -298059,12 +308316,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -298081,8 +308338,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -298116,7 +308373,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -298132,7 +308389,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -298145,19 +308407,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -298288,7 +308559,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -298301,7 +308572,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -298328,12 +308600,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -298343,14 +308616,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -298450,23 +308724,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -298536,7 +308815,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -298595,7 +308876,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -298823,13 +309108,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -298899,7 +309185,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -298914,19 +309201,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -298962,11 +309251,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -299006,7 +309296,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -299018,7 +309310,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -299045,17 +309337,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -299076,12 +309368,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -299098,8 +309390,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -299133,7 +309425,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -299149,7 +309441,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -299162,19 +309459,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -299305,7 +309611,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -299318,7 +309624,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -299345,12 +309652,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -299360,14 +309668,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -299467,23 +309776,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -299553,7 +309867,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -299612,7 +309928,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -299840,13 +310160,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -299916,7 +310237,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -299931,19 +310253,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -299979,11 +310303,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -300023,7 +310348,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -300035,7 +310362,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -300062,17 +310389,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -300093,12 +310420,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -300115,8 +310442,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -300150,7 +310477,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -300166,7 +310493,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -300179,19 +310511,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -300322,7 +310663,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -300335,7 +310676,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -300362,12 +310704,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -300377,14 +310720,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -300484,23 +310828,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -300570,7 +310919,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -300629,7 +310980,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -300857,13 +311212,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -300933,7 +311289,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -300948,19 +311305,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -300996,11 +311355,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -301040,7 +311400,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -301052,7 +311414,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -301079,17 +311441,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -301110,12 +311472,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -301132,8 +311494,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -301167,7 +311529,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -301183,7 +311545,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -301196,19 +311563,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -301339,7 +311715,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -301352,7 +311728,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -301379,12 +311756,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -301394,14 +311772,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -301501,23 +311880,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -301587,7 +311971,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -301646,7 +312032,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -301874,13 +312264,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -301950,7 +312341,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -301965,19 +312357,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -302013,11 +312407,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -302057,7 +312452,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -302069,7 +312466,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -302096,17 +312493,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -302127,12 +312524,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -302149,8 +312546,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -302184,7 +312581,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -302200,7 +312597,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -302213,19 +312615,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -302356,7 +312767,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -302369,7 +312780,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -302396,12 +312808,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -302411,14 +312824,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -302518,23 +312932,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -302604,7 +313023,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -302663,7 +313084,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -302891,13 +313316,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -302967,7 +313393,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -302982,19 +313409,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -303030,11 +313459,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -303074,7 +313504,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -303086,7 +313518,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -303113,17 +313545,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -303144,12 +313576,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -303166,8 +313598,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -303201,7 +313633,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -303217,7 +313649,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -303230,19 +313667,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -303373,7 +313819,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -303386,7 +313832,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -303413,12 +313860,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -303428,14 +313876,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -303535,23 +313984,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -303621,7 +314075,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -303680,7 +314136,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -303908,13 +314368,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -303984,7 +314445,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -303999,19 +314461,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -304047,11 +314511,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -304091,7 +314556,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -304103,7 +314570,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -304130,17 +314597,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -304161,12 +314628,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -304183,8 +314650,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -304218,7 +314685,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -304234,7 +314701,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -304247,19 +314719,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -304390,7 +314871,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -304403,7 +314884,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -304430,12 +314912,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -304445,14 +314928,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -304552,23 +315036,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -304638,7 +315127,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -304697,7 +315188,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -304925,13 +315420,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -305001,7 +315497,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -305016,19 +315513,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -305064,11 +315563,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -305108,7 +315608,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -305120,7 +315622,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -305147,17 +315649,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -305178,12 +315680,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -305200,8 +315702,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -305235,7 +315737,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -305251,7 +315753,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -305264,19 +315771,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -305407,7 +315923,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -305420,7 +315936,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -305447,12 +315964,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -305462,14 +315980,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -305569,23 +316088,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -305655,7 +316179,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -305714,7 +316240,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -305942,13 +316472,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -306018,7 +316549,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -306033,19 +316565,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -306081,11 +316615,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -306125,7 +316660,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -306137,7 +316674,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -306164,17 +316701,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -306195,12 +316732,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -306217,8 +316754,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -306252,7 +316789,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -306268,7 +316805,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -306281,19 +316823,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -306424,7 +316975,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -306437,7 +316988,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -306464,12 +317016,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -306479,14 +317032,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -306586,23 +317140,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -306672,7 +317231,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -306731,7 +317292,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -306959,13 +317524,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -307035,7 +317601,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -307050,19 +317617,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -307098,11 +317667,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -307142,7 +317712,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -307154,7 +317726,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -307181,17 +317753,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -307212,12 +317784,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -307234,8 +317806,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -307269,7 +317841,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -307285,7 +317857,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -307298,19 +317875,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -307441,7 +318027,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -307454,7 +318040,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -307481,12 +318068,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -307496,14 +318084,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -307603,23 +318192,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -307689,7 +318283,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -307748,7 +318344,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -307976,13 +318576,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -308052,7 +318653,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -308067,19 +318669,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -308115,11 +318719,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -308159,7 +318764,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -308171,7 +318778,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -308198,17 +318805,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -308229,12 +318836,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -308251,8 +318858,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -308286,7 +318893,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -308302,7 +318909,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -308315,19 +318927,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -308458,7 +319079,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -308471,7 +319092,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -308498,12 +319120,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -308513,14 +319136,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -308620,23 +319244,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -308706,7 +319335,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -308765,7 +319396,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -308993,13 +319628,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -309069,7 +319705,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -309084,19 +319721,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -309132,11 +319771,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -309176,7 +319816,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -309188,7 +319830,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -309215,17 +319857,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -309246,12 +319888,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -309268,8 +319910,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -309303,7 +319945,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -309319,7 +319961,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -309332,19 +319979,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -309475,7 +320131,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -309488,7 +320144,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -309515,12 +320172,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -309530,14 +320188,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -309637,23 +320296,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -309723,7 +320387,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -309782,7 +320448,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -310010,13 +320680,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -310086,7 +320757,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -310101,19 +320773,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -310149,11 +320823,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -310193,7 +320868,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -310205,7 +320882,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -310232,17 +320909,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -310263,12 +320940,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -310285,8 +320962,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -310320,7 +320997,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -310336,7 +321013,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -310349,19 +321031,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -310492,7 +321183,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -310505,7 +321196,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -310532,12 +321224,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -310547,14 +321240,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -310654,23 +321348,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -310740,7 +321439,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -310799,7 +321500,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -311027,13 +321732,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -311103,7 +321809,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -311118,19 +321825,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -311166,11 +321875,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -311210,7 +321920,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -311222,7 +321934,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -311249,17 +321961,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -311280,12 +321992,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -311302,8 +322014,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -311337,7 +322049,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -311353,7 +322065,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -311366,19 +322083,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -311509,7 +322235,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -311522,7 +322248,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -311549,12 +322276,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -311564,14 +322292,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -311671,23 +322400,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -311757,7 +322491,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -311816,7 +322552,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -312044,13 +322784,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -312120,7 +322861,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -312135,19 +322877,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -312183,11 +322927,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -312227,7 +322972,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -312239,7 +322986,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -312266,17 +323013,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -312297,12 +323044,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -312319,8 +323066,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -312354,7 +323101,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -312370,7 +323117,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -312383,19 +323135,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -312526,7 +323287,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -312539,7 +323300,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -312566,12 +323328,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -312581,14 +323344,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -312688,23 +323452,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -312774,7 +323543,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -312833,7 +323604,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -313061,13 +323836,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -313137,7 +323913,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -313152,19 +323929,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -313200,11 +323979,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -313244,7 +324024,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -313256,7 +324038,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -313283,17 +324065,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -313314,12 +324096,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -313336,8 +324118,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -313371,7 +324153,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -313387,7 +324169,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -313400,19 +324187,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -313543,7 +324339,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -313556,7 +324352,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -313583,12 +324380,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -313598,14 +324396,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -313705,23 +324504,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -313791,7 +324595,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -313850,7 +324656,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -314078,13 +324888,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -314154,7 +324965,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -314169,19 +324981,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -314217,11 +325031,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -314261,7 +325076,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -314273,7 +325090,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -314300,17 +325117,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -314331,12 +325148,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -314353,8 +325170,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -314388,7 +325205,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -314404,7 +325221,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -314417,19 +325239,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -314560,7 +325391,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -314573,7 +325404,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -314600,12 +325432,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -314615,14 +325448,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -314722,23 +325556,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -314808,7 +325647,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -314867,7 +325708,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -315095,13 +325940,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -315171,7 +326017,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -315186,19 +326033,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -315234,11 +326083,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -315278,7 +326128,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -315290,7 +326142,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -315317,17 +326169,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -315348,12 +326200,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -315370,8 +326222,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -315405,7 +326257,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -315421,7 +326273,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -315434,19 +326291,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -315577,7 +326443,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -315590,7 +326456,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -315617,12 +326484,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -315632,14 +326500,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -315739,23 +326608,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -315825,7 +326699,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -315884,7 +326760,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -316112,13 +326992,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -316188,7 +327069,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -316203,19 +327085,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -316251,11 +327135,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -316295,7 +327180,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -316307,7 +327194,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -316334,17 +327221,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -316365,12 +327252,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -316387,8 +327274,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -316422,7 +327309,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -316438,7 +327325,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -316451,19 +327343,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -316594,7 +327495,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -316607,7 +327508,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -316634,12 +327536,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -316649,14 +327552,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -316756,23 +327660,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -316842,7 +327751,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -316901,7 +327812,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -317129,13 +328044,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -317205,7 +328121,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -317220,19 +328137,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -317268,11 +328187,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -317312,7 +328232,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -317324,7 +328246,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -317351,17 +328273,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -317382,12 +328304,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -317404,8 +328326,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -317439,7 +328361,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -317455,7 +328377,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -317468,19 +328395,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -317611,7 +328547,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -317624,7 +328560,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -317651,12 +328588,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -317666,14 +328604,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -317773,23 +328712,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -317859,7 +328803,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -317918,7 +328864,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -318146,13 +329096,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -318222,7 +329173,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -318237,19 +329189,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -318285,11 +329239,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -318329,7 +329284,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -318341,7 +329298,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -318368,17 +329325,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -318399,12 +329356,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -318421,8 +329378,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -318456,7 +329413,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -318472,7 +329429,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -318485,19 +329447,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -318628,7 +329599,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -318641,7 +329612,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -318668,12 +329640,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -318683,14 +329656,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -318790,23 +329764,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -318876,7 +329855,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -318935,7 +329916,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -319163,13 +330148,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -319239,7 +330225,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -319254,19 +330241,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -319302,11 +330291,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -319346,7 +330336,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -319358,7 +330350,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -319385,17 +330377,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -319416,12 +330408,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -319438,8 +330430,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -319473,7 +330465,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -319489,7 +330481,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -319502,19 +330499,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -319645,7 +330651,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -319658,7 +330664,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -319685,12 +330692,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -319700,14 +330708,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -319807,23 +330816,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -319893,7 +330907,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -319952,7 +330968,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -320180,13 +331200,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -320256,7 +331277,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -320271,19 +331293,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -320319,11 +331343,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -320363,7 +331388,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -320375,7 +331402,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -320402,17 +331429,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -320433,12 +331460,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -320455,8 +331482,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -320490,7 +331517,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -320506,7 +331533,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -320519,19 +331551,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -320662,7 +331703,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -320675,7 +331716,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -320702,12 +331744,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -320717,14 +331760,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -320824,23 +331868,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -320910,7 +331959,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -320969,7 +332020,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -321197,13 +332252,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -321273,7 +332329,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -321288,19 +332345,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -321336,11 +332395,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -321380,7 +332440,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -321392,7 +332454,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -321419,17 +332481,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -321450,12 +332512,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -321472,8 +332534,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -321507,7 +332569,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -321523,7 +332585,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -321536,19 +332603,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -321679,7 +332755,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -321692,7 +332768,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -321719,12 +332796,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -321734,14 +332812,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -321841,23 +332920,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -321927,7 +333011,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -321986,7 +333072,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -322214,13 +333304,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -322290,7 +333381,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -322305,19 +333397,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -322353,11 +333447,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -322397,7 +333492,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -322409,7 +333506,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -322436,17 +333533,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -322467,12 +333564,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -322489,8 +333586,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -322524,7 +333621,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -322540,7 +333637,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -322553,19 +333655,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -322696,7 +333807,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -322709,7 +333820,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -322736,12 +333848,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -322751,14 +333864,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -322858,23 +333972,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -322944,7 +334063,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -323003,7 +334124,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -323231,13 +334356,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -323307,7 +334433,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -323322,19 +334449,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -323370,11 +334499,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -323414,7 +334544,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -323426,7 +334558,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -323453,17 +334585,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -323484,12 +334616,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -323506,8 +334638,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -323541,7 +334673,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -323557,7 +334689,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -323570,19 +334707,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -323713,7 +334859,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -323726,7 +334872,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -323753,12 +334900,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -323768,14 +334916,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -323875,23 +335024,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -323961,7 +335115,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -324020,7 +335176,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -324248,13 +335408,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -324324,7 +335485,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -324339,19 +335501,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -324387,11 +335551,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -324431,7 +335596,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -324443,7 +335610,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -324470,17 +335637,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -324501,12 +335668,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -324523,8 +335690,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -324558,7 +335725,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -324574,7 +335741,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -324587,19 +335759,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -324730,7 +335911,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -324743,7 +335924,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -324770,12 +335952,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -324785,14 +335968,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -324892,23 +336076,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -324978,7 +336167,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -325037,7 +336228,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -325265,13 +336460,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -325341,7 +336537,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -325356,19 +336553,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -325404,11 +336603,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -325448,7 +336648,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -325460,7 +336662,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -325487,17 +336689,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -325518,12 +336720,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -325540,8 +336742,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -325575,7 +336777,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -325591,7 +336793,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -325604,19 +336811,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -325747,7 +336963,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -325760,7 +336976,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -325787,12 +337004,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -325802,14 +337020,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -325909,23 +337128,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -325995,7 +337219,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -326054,7 +337280,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -326282,13 +337512,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -326358,7 +337589,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -326373,19 +337605,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -326421,11 +337655,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -326465,7 +337700,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -326477,7 +337714,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -326504,17 +337741,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -326535,12 +337772,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -326557,8 +337794,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -326592,7 +337829,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -326608,7 +337845,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -326621,19 +337863,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -326764,7 +338015,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -326777,7 +338028,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -326804,12 +338056,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -326819,14 +338072,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -326926,23 +338180,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -327012,7 +338271,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -327071,7 +338332,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -327299,13 +338564,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -327375,7 +338641,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -327390,19 +338657,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -327438,11 +338707,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -327482,7 +338752,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -327494,7 +338766,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -327521,17 +338793,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -327552,12 +338824,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -327574,8 +338846,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -327609,7 +338881,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -327625,7 +338897,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -327638,19 +338915,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -327781,7 +339067,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -327794,7 +339080,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -327821,12 +339108,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -327836,14 +339124,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -327943,23 +339232,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -328029,7 +339323,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -328088,7 +339384,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -328316,13 +339616,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -328392,7 +339693,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -328407,19 +339709,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -328455,11 +339759,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -328499,7 +339804,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -328511,7 +339818,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -328538,17 +339845,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -328569,12 +339876,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -328591,8 +339898,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -328626,7 +339933,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -328642,7 +339949,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -328655,19 +339967,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -328798,7 +340119,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -328811,7 +340132,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -328838,12 +340160,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -328853,14 +340176,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -328960,23 +340284,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -329046,7 +340375,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -329105,7 +340436,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -329333,13 +340668,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -329409,7 +340745,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -329424,19 +340761,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -329472,11 +340811,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -329516,7 +340856,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -329528,7 +340870,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -329555,17 +340897,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -329586,12 +340928,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -329608,8 +340950,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -329643,7 +340985,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -329659,7 +341001,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -329672,19 +341019,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -329815,7 +341171,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -329828,7 +341184,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -329855,12 +341212,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -329870,14 +341228,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -329977,23 +341336,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -330063,7 +341427,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -330122,7 +341488,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -330350,13 +341720,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -330426,7 +341797,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -330441,19 +341813,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -330489,11 +341863,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -330533,7 +341908,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -330545,7 +341922,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -330572,17 +341949,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -330603,12 +341980,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -330625,8 +342002,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -330660,7 +342037,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -330676,7 +342053,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -330689,19 +342071,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -330832,7 +342223,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -330845,7 +342236,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -330872,12 +342264,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -330887,14 +342280,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -330994,23 +342388,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -331080,7 +342479,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -331139,7 +342540,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -331367,13 +342772,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -331443,7 +342849,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -331458,19 +342865,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -331506,11 +342915,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -331550,7 +342960,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -331562,7 +342974,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -331589,17 +343001,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -331620,12 +343032,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -331642,8 +343054,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -331677,7 +343089,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -331693,7 +343105,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -331706,19 +343123,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -331849,7 +343275,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -331862,7 +343288,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -331889,12 +343316,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -331904,14 +343332,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -332011,23 +343440,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -332097,7 +343531,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -332156,7 +343592,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -332384,13 +343824,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -332460,7 +343901,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -332475,19 +343917,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -332523,11 +343967,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -332567,7 +344012,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -332579,7 +344026,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -332606,17 +344053,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -332637,12 +344084,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -332659,8 +344106,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -332694,7 +344141,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -332710,7 +344157,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -332723,19 +344175,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -332866,7 +344327,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -332879,7 +344340,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -332906,12 +344368,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -332921,14 +344384,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -333028,23 +344492,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -333114,7 +344583,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -333173,7 +344644,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -333401,13 +344876,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -333477,7 +344953,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -333492,19 +344969,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -333540,11 +345019,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -333584,7 +345064,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -333596,7 +345078,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -333623,17 +345105,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -333654,12 +345136,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -333676,8 +345158,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -333711,7 +345193,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -333727,7 +345209,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -333740,19 +345227,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -333883,7 +345379,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -333896,7 +345392,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -333923,12 +345420,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -333938,14 +345436,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -334045,23 +345544,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -334131,7 +345635,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -334190,7 +345696,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -334418,13 +345928,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -334494,7 +346005,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -334509,19 +346021,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -334557,11 +346071,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -334601,7 +346116,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -334613,7 +346130,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -334640,17 +346157,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -334671,12 +346188,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -334693,8 +346210,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -334728,7 +346245,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -334744,7 +346261,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -334757,19 +346279,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -334900,7 +346431,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -334913,7 +346444,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -334940,12 +346472,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -334955,14 +346488,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -335062,23 +346596,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -335148,7 +346687,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -335207,7 +346748,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -335435,13 +346980,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -335511,7 +347057,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -335526,19 +347073,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -335574,11 +347123,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -335618,7 +347168,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -335630,7 +347182,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -335657,17 +347209,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -335688,12 +347240,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -335710,8 +347262,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -335745,7 +347297,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -335761,7 +347313,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -335774,19 +347331,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -335917,7 +347483,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -335930,7 +347496,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -335957,12 +347524,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -335972,14 +347540,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -336079,23 +347648,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -336165,7 +347739,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -336224,7 +347800,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -336452,13 +348032,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -336528,7 +348109,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -336543,19 +348125,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -336591,11 +348175,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -336635,7 +348220,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -336647,7 +348234,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -336674,17 +348261,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -336705,12 +348292,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -336727,8 +348314,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -336762,7 +348349,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -336778,7 +348365,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -336791,19 +348383,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -336934,7 +348535,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -336947,7 +348548,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -336974,12 +348576,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -336989,14 +348592,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -337096,23 +348700,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -337182,7 +348791,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -337241,7 +348852,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -337469,13 +349084,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -337545,7 +349161,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -337560,19 +349177,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -337608,11 +349227,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -337652,7 +349272,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -337664,7 +349286,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -337691,17 +349313,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -337722,12 +349344,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -337744,8 +349366,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -337779,7 +349401,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -337795,7 +349417,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -337808,19 +349435,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -337951,7 +349587,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -337964,7 +349600,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -337991,12 +349628,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -338006,14 +349644,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -338113,23 +349752,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -338199,7 +349843,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -338258,7 +349904,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -338486,13 +350136,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -338562,7 +350213,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -338577,19 +350229,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -338625,11 +350279,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -338669,7 +350324,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -338681,7 +350338,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -338708,17 +350365,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -338739,12 +350396,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -338761,8 +350418,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -338796,7 +350453,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -338812,7 +350469,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -338825,19 +350487,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -338968,7 +350639,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -338981,7 +350652,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -339008,12 +350680,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -339023,14 +350696,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -339130,23 +350804,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -339216,7 +350895,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -339275,7 +350956,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -339503,13 +351188,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -339579,7 +351265,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -339594,19 +351281,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -339642,11 +351331,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -339686,7 +351376,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -339698,7 +351390,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -339725,17 +351417,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -339756,12 +351448,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -339778,8 +351470,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -339813,7 +351505,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -339829,7 +351521,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -339842,19 +351539,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -339985,7 +351691,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -339998,7 +351704,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -340025,12 +351732,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -340040,14 +351748,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -340147,23 +351856,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -340233,7 +351947,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -340292,7 +352008,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -340520,13 +352240,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -340596,7 +352317,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -340611,19 +352333,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -340659,11 +352383,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -340703,7 +352428,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -340715,7 +352442,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -340742,17 +352469,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -340773,12 +352500,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -340795,8 +352522,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -340830,7 +352557,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -340846,7 +352573,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -340859,19 +352591,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -341002,7 +352743,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -341015,7 +352756,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -341042,12 +352784,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -341057,14 +352800,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -341164,23 +352908,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -341250,7 +352999,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -341309,7 +353060,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -341537,13 +353292,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -341613,7 +353369,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -341628,19 +353385,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -341676,11 +353435,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -341720,7 +353480,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -341732,7 +353494,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -341759,17 +353521,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -341790,12 +353552,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -341812,8 +353574,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -341847,7 +353609,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -341863,7 +353625,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -341876,19 +353643,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -342019,7 +353795,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -342032,7 +353808,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -342059,12 +353836,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -342074,14 +353852,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -342181,23 +353960,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -342267,7 +354051,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -342326,7 +354112,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -342554,13 +354344,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -342630,7 +354421,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -342645,19 +354437,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -342693,11 +354487,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -342737,7 +354532,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -342749,7 +354546,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -342776,17 +354573,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -342807,12 +354604,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -342829,8 +354626,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -342864,7 +354661,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -342880,7 +354677,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -342893,19 +354695,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -343036,7 +354847,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -343049,7 +354860,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -343076,12 +354888,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -343091,14 +354904,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -343198,23 +355012,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -343284,7 +355103,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -343343,7 +355164,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -343571,13 +355396,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -343647,7 +355473,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -343662,19 +355489,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -343710,11 +355539,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -343754,7 +355584,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -343766,7 +355598,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -343793,17 +355625,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -343824,12 +355656,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -343846,8 +355678,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -343881,7 +355713,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -343897,7 +355729,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -343910,19 +355747,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -344053,7 +355899,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -344066,7 +355912,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -344093,12 +355940,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -344108,14 +355956,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -344215,23 +356064,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -344301,7 +356155,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -344360,7 +356216,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -344588,13 +356448,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -344664,7 +356525,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -344679,19 +356541,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -344727,11 +356591,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -344771,7 +356636,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -344783,7 +356650,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -344810,17 +356677,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -344841,12 +356708,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -344863,8 +356730,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -344898,7 +356765,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -344914,7 +356781,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -344927,19 +356799,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -345070,7 +356951,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -345083,7 +356964,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -345110,12 +356992,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -345125,14 +357008,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -345232,23 +357116,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -345318,7 +357207,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -345377,7 +357268,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -345605,13 +357500,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -345681,7 +357577,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -345696,19 +357593,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -345744,11 +357643,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -345788,7 +357688,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -345800,7 +357702,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -345827,17 +357729,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -345858,12 +357760,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -345880,8 +357782,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -345915,7 +357817,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -345931,7 +357833,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -345944,19 +357851,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -346087,7 +358003,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -346100,7 +358016,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -346127,12 +358044,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -346142,14 +358060,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -346249,23 +358168,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -346335,7 +358259,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -346394,7 +358320,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -346622,13 +358552,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -346698,7 +358629,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -346713,19 +358645,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -346761,11 +358695,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -346805,7 +358740,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -346817,7 +358754,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -346844,17 +358781,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -346875,12 +358812,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -346897,8 +358834,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -346932,7 +358869,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -346948,7 +358885,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -346961,19 +358903,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -347104,7 +359055,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -347117,7 +359068,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -347144,12 +359096,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -347159,14 +359112,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -347266,23 +359220,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -347352,7 +359311,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -347411,7 +359372,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -347639,13 +359604,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -347715,7 +359681,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -347730,19 +359697,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -347778,11 +359747,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -347822,7 +359792,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -347834,7 +359806,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -347861,17 +359833,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -347892,12 +359864,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -347914,8 +359886,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -347949,7 +359921,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -347965,7 +359937,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -347978,19 +359955,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -348121,7 +360107,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -348134,7 +360120,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -348161,12 +360148,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -348176,14 +360164,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -348283,23 +360272,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -348369,7 +360363,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -348428,7 +360424,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -348656,13 +360656,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -348732,7 +360733,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -348747,19 +360749,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -348795,11 +360799,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -348839,7 +360844,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -348851,7 +360858,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -348878,17 +360885,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -348909,12 +360916,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -348931,8 +360938,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -348966,7 +360973,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -348982,7 +360989,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -348995,19 +361007,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -349138,7 +361159,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -349151,7 +361172,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -349178,12 +361200,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -349193,14 +361216,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -349300,23 +361324,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -349386,7 +361415,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -349445,7 +361476,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -349673,13 +361708,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -349749,7 +361785,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -349764,19 +361801,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -349812,11 +361851,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -349856,7 +361896,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -349868,7 +361910,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -349895,17 +361937,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -349926,12 +361968,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -349948,8 +361990,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -349983,7 +362025,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -349999,7 +362041,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -350012,19 +362059,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -350155,7 +362211,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -350168,7 +362224,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -350195,12 +362252,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -350210,14 +362268,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -350317,23 +362376,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -350403,7 +362467,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -350462,7 +362528,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -350690,13 +362760,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -350766,7 +362837,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -350781,19 +362853,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -350829,11 +362903,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -350873,7 +362948,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -350885,7 +362962,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -350912,17 +362989,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -350943,12 +363020,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -350965,8 +363042,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -351000,7 +363077,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -351016,7 +363093,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -351029,19 +363111,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -351172,7 +363263,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -351185,7 +363276,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -351212,12 +363304,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -351227,14 +363320,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -351334,23 +363428,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -351420,7 +363519,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -351479,7 +363580,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -351707,13 +363812,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -351783,7 +363889,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -351798,19 +363905,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -351846,11 +363955,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -351890,7 +364000,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -351902,7 +364014,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -351929,17 +364041,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -351960,12 +364072,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -351982,8 +364094,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -352017,7 +364129,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -352033,7 +364145,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -352046,19 +364163,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -352189,7 +364315,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -352202,7 +364328,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -352229,12 +364356,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -352244,14 +364372,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -352351,23 +364480,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -352437,7 +364571,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -352496,7 +364632,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -352724,13 +364864,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -352800,7 +364941,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -352815,19 +364957,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -352863,11 +365007,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -352907,7 +365052,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -352919,7 +365066,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -352946,17 +365093,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -352977,12 +365124,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -352999,8 +365146,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -353034,7 +365181,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -353050,7 +365197,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -353063,19 +365215,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -353206,7 +365367,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -353219,7 +365380,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -353246,12 +365408,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -353261,14 +365424,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -353368,23 +365532,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -353454,7 +365623,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -353513,7 +365684,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -353741,13 +365916,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -353817,7 +365993,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -353832,19 +366009,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -353880,11 +366059,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -353924,7 +366104,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -353936,7 +366118,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -353963,17 +366145,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -353994,12 +366176,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -354016,8 +366198,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -354051,7 +366233,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -354067,7 +366249,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -354080,19 +366267,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -354223,7 +366419,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -354236,7 +366432,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -354263,12 +366460,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -354278,14 +366476,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -354385,23 +366584,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -354471,7 +366675,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -354530,7 +366736,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -354758,13 +366968,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -354834,7 +367045,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -354849,19 +367061,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -354897,11 +367111,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -354941,7 +367156,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -354953,7 +367170,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -354980,17 +367197,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -355011,12 +367228,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -355033,8 +367250,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -355068,7 +367285,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -355084,7 +367301,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -355097,19 +367319,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -355240,7 +367471,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -355253,7 +367484,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -355280,12 +367512,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -355295,14 +367528,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -355402,23 +367636,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -355488,7 +367727,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -355547,7 +367788,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -355775,13 +368020,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -355851,7 +368097,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -355866,19 +368113,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -355914,11 +368163,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -355958,7 +368208,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -355970,7 +368222,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -355997,17 +368249,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -356028,12 +368280,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -356050,8 +368302,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -356085,7 +368337,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -356101,7 +368353,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -356114,19 +368371,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -356257,7 +368523,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -356270,7 +368536,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -356297,12 +368564,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -356312,14 +368580,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -356419,23 +368688,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -356505,7 +368779,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -356564,7 +368840,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -356792,13 +369072,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -356868,7 +369149,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -356883,19 +369165,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -356931,11 +369215,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -356975,7 +369260,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -356987,7 +369274,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -357014,17 +369301,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -357045,12 +369332,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -357067,8 +369354,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -357102,7 +369389,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -357118,7 +369405,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -357131,19 +369423,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -357274,7 +369575,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -357287,7 +369588,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -357314,12 +369616,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -357329,14 +369632,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -357436,23 +369740,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -357522,7 +369831,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -357581,7 +369892,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -357809,13 +370124,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -357885,7 +370201,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -357900,19 +370217,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -357948,11 +370267,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -357992,7 +370312,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -358004,7 +370326,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -358031,17 +370353,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -358062,12 +370384,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -358084,8 +370406,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -358119,7 +370441,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -358135,7 +370457,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -358148,19 +370475,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -358291,7 +370627,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -358304,7 +370640,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -358331,12 +370668,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -358346,14 +370684,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -358453,23 +370792,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -358539,7 +370883,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -358598,7 +370944,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -358826,13 +371176,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -358902,7 +371253,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -358917,19 +371269,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -358965,11 +371319,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -359009,7 +371364,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -359021,7 +371378,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -359048,17 +371405,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -359079,12 +371436,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -359101,8 +371458,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -359136,7 +371493,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -359152,7 +371509,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -359165,19 +371527,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -359308,7 +371679,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -359321,7 +371692,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -359348,12 +371720,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -359363,14 +371736,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -359470,23 +371844,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -359556,7 +371935,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -359615,7 +371996,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -359843,13 +372228,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -359919,7 +372305,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -359934,19 +372321,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -359982,11 +372371,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -360026,7 +372416,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -360038,7 +372430,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -360065,17 +372457,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -360096,12 +372488,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -360118,8 +372510,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -360153,7 +372545,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -360169,7 +372561,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -360182,19 +372579,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -360325,7 +372731,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -360338,7 +372744,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -360365,12 +372772,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -360380,14 +372788,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -360487,23 +372896,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -360573,7 +372987,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -360632,7 +373048,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -360860,13 +373280,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -360936,7 +373357,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -360951,19 +373373,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -360999,11 +373423,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -361043,7 +373468,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -361055,7 +373482,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -361082,17 +373509,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -361113,12 +373540,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -361135,8 +373562,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -361170,7 +373597,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -361186,7 +373613,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -361199,19 +373631,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -361342,7 +373783,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -361355,7 +373796,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -361382,12 +373824,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -361397,14 +373840,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -361504,23 +373948,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -361590,7 +374039,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -361649,7 +374100,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -361877,13 +374332,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -361953,7 +374409,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -361968,19 +374425,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -362016,11 +374475,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -362060,7 +374520,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -362072,7 +374534,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -362099,17 +374561,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -362130,12 +374592,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -362152,8 +374614,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -362187,7 +374649,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -362203,7 +374665,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -362216,19 +374683,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -362359,7 +374835,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -362372,7 +374848,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -362399,12 +374876,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -362414,14 +374892,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -362521,23 +375000,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -362607,7 +375091,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -362666,7 +375152,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -362894,13 +375384,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -362970,7 +375461,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -362985,19 +375477,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -363033,11 +375527,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -363077,7 +375572,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -363089,7 +375586,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -363116,17 +375613,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -363147,12 +375644,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -363169,8 +375666,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -363204,7 +375701,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -363220,7 +375717,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -363233,19 +375735,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -363376,7 +375887,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -363389,7 +375900,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -363416,12 +375928,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -363431,14 +375944,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -363538,23 +376052,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -363624,7 +376143,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -363683,7 +376204,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -363911,13 +376436,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -363987,7 +376513,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -364002,19 +376529,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -364050,11 +376579,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -364094,7 +376624,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -364106,7 +376638,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -364133,17 +376665,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -364164,12 +376696,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -364186,8 +376718,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -364221,7 +376753,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -364237,7 +376769,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -364250,19 +376787,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -364393,7 +376939,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -364406,7 +376952,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -364433,12 +376980,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -364448,14 +376996,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -364555,23 +377104,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -364641,7 +377195,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -364700,7 +377256,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -364928,13 +377488,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -365004,7 +377565,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -365019,19 +377581,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -365067,11 +377631,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -365111,7 +377676,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -365123,7 +377690,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -365150,17 +377717,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -365181,12 +377748,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -365203,8 +377770,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -365238,7 +377805,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -365254,7 +377821,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -365267,19 +377839,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -365410,7 +377991,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -365423,7 +378004,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -365450,12 +378032,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -365465,14 +378048,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -365572,23 +378156,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -365658,7 +378247,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -365717,7 +378308,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -365945,13 +378540,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -366021,7 +378617,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -366036,19 +378633,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -366084,11 +378683,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -366128,7 +378728,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -366140,7 +378742,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -366167,17 +378769,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -366198,12 +378800,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -366220,8 +378822,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -366255,7 +378857,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -366271,7 +378873,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -366284,19 +378891,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -366427,7 +379043,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -366440,7 +379056,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -366467,12 +379084,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -366482,14 +379100,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -366589,23 +379208,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -366675,7 +379299,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -366734,7 +379360,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -366962,13 +379592,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -367038,7 +379669,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -367053,19 +379685,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -367101,11 +379735,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -367145,7 +379780,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -367157,7 +379794,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -367184,17 +379821,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -367215,12 +379852,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -367237,8 +379874,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -367272,7 +379909,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -367288,7 +379925,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -367301,19 +379943,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -367444,7 +380095,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -367457,7 +380108,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -367484,12 +380136,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -367499,14 +380152,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -367606,23 +380260,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -367692,7 +380351,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -367751,7 +380412,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -367979,13 +380644,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -368055,7 +380721,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -368070,19 +380737,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -368118,11 +380787,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -368162,7 +380832,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -368174,7 +380846,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -368201,17 +380873,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -368232,12 +380904,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -368254,8 +380926,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -368289,7 +380961,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -368305,7 +380977,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -368318,19 +380995,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -368461,7 +381147,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -368474,7 +381160,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -368501,12 +381188,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -368516,14 +381204,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -368623,23 +381312,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -368709,7 +381403,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -368768,7 +381464,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -368996,13 +381696,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -369072,7 +381773,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -369087,19 +381789,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -369135,11 +381839,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -369179,7 +381884,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -369191,7 +381898,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -369218,17 +381925,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -369249,12 +381956,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -369271,8 +381978,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -369306,7 +382013,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -369322,7 +382029,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -369335,19 +382047,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -369478,7 +382199,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -369491,7 +382212,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -369518,12 +382240,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -369533,14 +382256,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -369640,23 +382364,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -369726,7 +382455,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -369785,7 +382516,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -370013,13 +382748,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -370089,7 +382825,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -370104,19 +382841,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -370152,11 +382891,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -370196,7 +382936,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -370208,7 +382950,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -370235,17 +382977,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -370266,12 +383008,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -370288,8 +383030,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -370323,7 +383065,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -370339,7 +383081,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -370352,19 +383099,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -370495,7 +383251,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -370508,7 +383264,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -370535,12 +383292,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -370550,14 +383308,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -370657,23 +383416,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -370743,7 +383507,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -370802,7 +383568,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -371030,13 +383800,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -371106,7 +383877,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -371121,19 +383893,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -371169,11 +383943,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -371213,7 +383988,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -371225,7 +384002,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -371252,17 +384029,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -371283,12 +384060,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -371305,8 +384082,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -371340,7 +384117,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -371356,7 +384133,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -371369,19 +384151,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -371512,7 +384303,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -371525,7 +384316,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -371552,12 +384344,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -371567,14 +384360,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -371674,23 +384468,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -371760,7 +384559,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -371819,7 +384620,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -372047,13 +384852,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -372123,7 +384929,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -372138,19 +384945,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -372186,11 +384995,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -372230,7 +385040,9 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml,7
 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml,7
 T1066,No,-,0
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,1
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/anomalous_usage_of_7zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3
 T1021.005,No,-,0
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5
@@ -372242,7 +385054,7 @@ T1113,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1067,No,-,0
 T1037,No,-,0
 T1557,No,-,0
-T1033,No,-,0
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_taskhost_processes.yml,1
 T1583,No,-,0
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml,9
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml,9
@@ -372269,17 +385081,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,32
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -372300,12 +385112,12 @@ T1590.002,No,-,0
 T1501,No,-,0
 T1514,No,-,0
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,1
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,9
-T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,9
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_ransomware_known_service_name.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
+T1543,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_process_file_path.yml,10
 T1133,No,-,0
 T1109,No,-,0
 T1546.006,No,-,0
@@ -372322,8 +385134,8 @@ T1016.001,No,-,0
 T1548.003,No,-,0
 T1560.003,No,-,0
 T1578,No,-,0
-T1069,No,-,1
-T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,4
+T1069,No,-,11
+T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
@@ -372357,7 +385169,7 @@ T1587.003,No,-,0
 T1565.001,No,-,0
 T1110.002,No,-,0
 T1178,No,-,0
-T1114.001,No,-,0
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1
 T1555.001,No,-,0
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5
 T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5
@@ -372373,7 +385185,12 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windo
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,1
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/account_discovery_with_net_app.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,6
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,6
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -372386,19 +385203,28 @@ T1592.001,No,-,0
 T1080,No,-,0
 T1484.002,No,-,0
 T1573.001,No,-,0
-T1087.001,No,-,0
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1167,No,-,0
 T1586.001,No,-,0
 T1527,No,-,0
 T1180,No,-,0
 T1542.005,No,-,0
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,3
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,3
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sc_exe_manipulating_windows_services.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_driver_loaded_path.yml,4
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/xmrig_driver_loaded.yml,4
 T1568.001,No,-,0
 T1497.001,No,-,0
 T1053.003,No,-,0
-T1069.002,No,-,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1588.006,No,-,0
 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_creating_lnk_file_in_suspicious_location.yml,1
 T1165,No,-,0
@@ -372529,7 +385355,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,28
+T1218,No,-,29
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -372542,7 +385368,8 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml,2
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
@@ -372569,12 +385396,13 @@ T1131,No,-,0
 T1181,No,-,0
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/processes_created_by_netsh.yml,2
 T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml,2
-T1560,No,-,1
+T1560,No,-,3
 T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enable_rdp_in_other_port_number.yml,9
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml,9
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -372584,14 +385412,15 @@ T1553.006,No,-,0
 T1610,No,-,0
 T1107,No,-,0
 T1145,No,-,0
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,2
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,2
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_registry_entry.yml,3
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_reg_exe_process.yml,3
 T1543.004,No,-,0
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_accessdenied_discovery_events.yml,2
 T1580,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_assume_role_policy_brute_force.yml,2
 T1555.003,No,-,0
 T1574.008,No,-,0
-T1491,No,-,0
+T1491,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modification_of_wallpaper.yml,1
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_compute_instance_created_in_previously_unused_region.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_city.yml,8
 T1535,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_aws_console_login_by_user_from_new_country.yml,8
@@ -372691,23 +385520,28 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,6
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/enumerate_users_local_group_using_telegram.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,19
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dsquery_domain_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nltest_domain_trust_discovery.yml,8
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,8
 T1558.001,No,-,0
 T1175,No,-,0
 T1020,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml,2
@@ -372777,7 +385611,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,4
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,6
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,6
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -372836,7 +385672,11 @@ T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_add_app_role_assignment_grant_user.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_added_service_principal.yml,6
 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_new_federated_domain_added.yml,6
-T1069.001,No,-,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_azurehound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_command_line_arguments.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_file_modifications.yml,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_sharphound_usage.yml,5
 T1149,No,-,0
 T1593,No,-,0
 T1098,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_delete_policy.yml,15
@@ -373064,13 +385904,14 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,5
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,5
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,6
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ryuk_wake_on_lan_command.yml,6
 T1055.009,No,-,0
 T1223,No,-,0
 T1601.001,No,-,0
@@ -373140,7 +385981,8 @@ T1126,No,-,0
 T1084,No,-,0
 T1160,No,-,0
 T1055.008,No,-,0
-T1021.001,No,-,0
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,2
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_inbound_traffic_in_firewall_rule.yml,2
 T1037.001,No,-,0
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4
 T1484,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4
@@ -373155,19 +385997,21 @@ T1591.001,No,-,0
 T1137.002,No,-,0
 T1587,No,-,0
 T1173,No,-,0
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,6
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ntdsutil_export_ntds.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/secretdumps_offline_ntds_dumping_tool.yml,7
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,7
 T1602.001,No,-,0
 T1001.002,No,-,0
 T1204.001,No,-,0
 T1550.001,No,-,0
 T1547.008,No,-,0
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,2
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,2
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_psexec.yml,3
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_executed_as_a_service.yml,3
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml,17
 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_create_policy_version_to_allow_all_resources.yml,17
@@ -373203,11 +386047,12 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,5
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/experimental/delete_shadowcopy_with_powershell.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index c1c6658586..03a3366024 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -13,8 +13,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -31,7 +31,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -59,7 +63,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -92,7 +96,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -114,7 +118,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -161,7 +165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -183,8 +191,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -200,7 +208,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -208,13 +220,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -397,8 +413,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -440,8 +456,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -461,8 +477,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -472,7 +488,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -596,13 +616,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -610,8 +630,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -701,8 +721,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -794,7 +814,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -1044,13 +1068,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -1153,7 +1177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -1174,8 +1202,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -1184,8 +1212,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -1217,8 +1245,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -1269,8 +1297,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -1287,7 +1315,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -1315,7 +1347,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -1348,7 +1380,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -1370,7 +1402,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -1417,7 +1449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -1439,8 +1475,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -1456,7 +1492,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -1464,13 +1504,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -1653,8 +1697,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -1696,8 +1740,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -1717,8 +1761,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -1728,7 +1772,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -1852,13 +1900,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -1866,8 +1914,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -1957,8 +2005,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -2050,7 +2098,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -2300,13 +2352,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -2409,7 +2461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -2430,8 +2486,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -2440,8 +2496,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -2473,8 +2529,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -2525,8 +2581,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -2543,7 +2599,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -2571,7 +2631,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -2604,7 +2664,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -2626,7 +2686,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -2673,7 +2733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -2695,8 +2759,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -2712,7 +2776,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -2720,13 +2788,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -2909,8 +2981,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -2952,8 +3024,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -2973,8 +3045,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -2984,7 +3056,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -3108,13 +3184,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -3122,8 +3198,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -3213,8 +3289,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -3306,7 +3382,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -3556,13 +3636,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -3665,7 +3745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -3686,8 +3770,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -3696,8 +3780,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -3729,8 +3813,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -3781,8 +3865,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -3799,7 +3883,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -3827,7 +3915,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -3860,7 +3948,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -3882,7 +3970,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -3929,7 +4017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -3951,8 +4043,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -3968,7 +4060,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -3976,13 +4072,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -4165,8 +4265,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -4208,8 +4308,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -4229,8 +4329,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -4240,7 +4340,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -4364,13 +4468,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -4378,8 +4482,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -4469,8 +4573,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -4562,7 +4666,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -4812,13 +4920,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -4921,7 +5029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -4942,8 +5054,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -4952,8 +5064,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -4985,8 +5097,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -5037,8 +5149,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -5055,7 +5167,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -5083,7 +5199,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -5116,7 +5232,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -5138,7 +5254,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -5185,7 +5301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -5207,8 +5327,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -5224,7 +5344,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -5232,13 +5356,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -5421,8 +5549,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -5464,8 +5592,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -5485,8 +5613,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -5496,7 +5624,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -5620,13 +5752,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -5634,8 +5766,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -5725,8 +5857,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -5818,7 +5950,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -6068,13 +6204,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -6177,7 +6313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -6198,8 +6338,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -6208,8 +6348,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -6241,8 +6381,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -6293,8 +6433,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -6311,7 +6451,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -6339,7 +6483,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -6372,7 +6516,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -6394,7 +6538,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -6441,7 +6585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -6463,8 +6611,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -6480,7 +6628,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -6488,13 +6640,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -6677,8 +6833,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -6720,8 +6876,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -6741,8 +6897,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -6752,7 +6908,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -6876,13 +7036,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -6890,8 +7050,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -6981,8 +7141,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -7074,7 +7234,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -7324,13 +7488,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -7433,7 +7597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -7454,8 +7622,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -7464,8 +7632,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -7497,8 +7665,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -7549,8 +7717,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -7567,7 +7735,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -7595,7 +7767,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -7628,7 +7800,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -7650,7 +7822,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -7697,7 +7869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -7719,8 +7895,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -7736,7 +7912,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -7744,13 +7924,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -7933,8 +8117,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -7976,8 +8160,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -7997,8 +8181,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -8008,7 +8192,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -8132,13 +8320,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -8146,8 +8334,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -8237,8 +8425,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -8330,7 +8518,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -8580,13 +8772,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -8689,7 +8881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -8710,8 +8906,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -8720,8 +8916,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -8753,8 +8949,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -8805,8 +9001,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -8823,7 +9019,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -8851,7 +9051,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -8884,7 +9084,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -8906,7 +9106,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -8953,7 +9153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -8975,8 +9179,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -8992,7 +9196,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -9000,13 +9208,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -9189,8 +9401,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -9232,8 +9444,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -9253,8 +9465,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -9264,7 +9476,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -9388,13 +9604,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -9402,8 +9618,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -9493,8 +9709,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -9586,7 +9802,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -9836,13 +10056,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -9945,7 +10165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -9966,8 +10190,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -9976,8 +10200,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -10009,8 +10233,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -10061,8 +10285,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -10079,7 +10303,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -10107,7 +10335,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -10140,7 +10368,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -10162,7 +10390,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -10209,7 +10437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -10231,8 +10463,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -10248,7 +10480,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -10256,13 +10492,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -10445,8 +10685,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -10488,8 +10728,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -10509,8 +10749,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -10520,7 +10760,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -10644,13 +10888,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -10658,8 +10902,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -10749,8 +10993,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -10842,7 +11086,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -11092,13 +11340,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -11201,7 +11449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -11222,8 +11474,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -11232,8 +11484,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -11265,8 +11517,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -11317,8 +11569,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -11335,7 +11587,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -11363,7 +11619,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -11396,7 +11652,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -11418,7 +11674,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -11465,7 +11721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -11487,8 +11747,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -11504,7 +11764,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -11512,13 +11776,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -11701,8 +11969,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -11744,8 +12012,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -11765,8 +12033,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -11776,7 +12044,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -11900,13 +12172,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -11914,8 +12186,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -12005,8 +12277,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -12098,7 +12370,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -12348,13 +12624,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -12457,7 +12733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -12478,8 +12758,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -12488,8 +12768,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -12521,8 +12801,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -12573,8 +12853,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -12591,7 +12871,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -12619,7 +12903,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -12652,7 +12936,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -12674,7 +12958,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -12721,7 +13005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -12743,8 +13031,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -12760,7 +13048,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -12768,13 +13060,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -12957,8 +13253,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -13000,8 +13296,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -13021,8 +13317,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -13032,7 +13328,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -13156,13 +13456,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -13170,8 +13470,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -13261,8 +13561,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -13354,7 +13654,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -13604,13 +13908,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -13713,7 +14017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -13734,8 +14042,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -13744,8 +14052,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -13777,8 +14085,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -13829,8 +14137,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -13847,7 +14155,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -13875,7 +14187,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -13908,7 +14220,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -13930,7 +14242,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -13977,7 +14289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -13999,8 +14315,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -14016,7 +14332,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -14024,13 +14344,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -14213,8 +14537,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -14256,8 +14580,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -14277,8 +14601,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -14288,7 +14612,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -14412,13 +14740,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -14426,8 +14754,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -14517,8 +14845,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -14610,7 +14938,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -14860,13 +15192,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -14969,7 +15301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -14990,8 +15326,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -15000,8 +15336,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -15033,8 +15369,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -15085,8 +15421,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -15103,7 +15439,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -15131,7 +15471,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -15164,7 +15504,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -15186,7 +15526,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -15233,7 +15573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -15255,8 +15599,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -15272,7 +15616,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -15280,13 +15628,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -15469,8 +15821,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -15512,8 +15864,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -15533,8 +15885,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -15544,7 +15896,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -15668,13 +16024,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -15682,8 +16038,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -15773,8 +16129,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -15866,7 +16222,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -16116,13 +16476,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -16225,7 +16585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -16246,8 +16610,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -16256,8 +16620,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -16289,8 +16653,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -16341,8 +16705,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -16359,7 +16723,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -16387,7 +16755,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -16420,7 +16788,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -16442,7 +16810,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -16489,7 +16857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -16511,8 +16883,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -16528,7 +16900,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -16536,13 +16912,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -16725,8 +17105,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -16768,8 +17148,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -16789,8 +17169,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -16800,7 +17180,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -16924,13 +17308,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -16938,8 +17322,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -17029,8 +17413,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -17122,7 +17506,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -17372,13 +17760,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -17481,7 +17869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -17502,8 +17894,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -17512,8 +17904,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -17545,8 +17937,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -17597,8 +17989,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -17615,7 +18007,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -17643,7 +18039,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -17676,7 +18072,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -17698,7 +18094,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -17745,7 +18141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -17767,8 +18167,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -17784,7 +18184,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -17792,13 +18196,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -17981,8 +18389,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -18024,8 +18432,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -18045,8 +18453,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -18056,7 +18464,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -18180,13 +18592,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -18194,8 +18606,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -18285,8 +18697,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -18378,7 +18790,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -18628,13 +19044,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -18737,7 +19153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -18758,8 +19178,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -18768,8 +19188,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -18801,8 +19221,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -18853,8 +19273,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -18871,7 +19291,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -18899,7 +19323,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -18932,7 +19356,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -18954,7 +19378,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -19001,7 +19425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -19023,8 +19451,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -19040,7 +19468,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -19048,13 +19480,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -19237,8 +19673,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -19280,8 +19716,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -19301,8 +19737,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -19312,7 +19748,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -19436,13 +19876,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -19450,8 +19890,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -19541,8 +19981,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -19634,7 +20074,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -19884,13 +20328,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -19993,7 +20437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -20014,8 +20462,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -20024,8 +20472,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -20057,8 +20505,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -20109,8 +20557,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -20127,7 +20575,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -20155,7 +20607,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -20188,7 +20640,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -20210,7 +20662,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -20257,7 +20709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -20279,8 +20735,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -20296,7 +20752,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -20304,13 +20764,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -20493,8 +20957,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -20536,8 +21000,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -20557,8 +21021,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -20568,7 +21032,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -20692,13 +21160,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -20706,8 +21174,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -20797,8 +21265,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -20890,7 +21358,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -21140,13 +21612,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -21249,7 +21721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -21270,8 +21746,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -21280,8 +21756,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -21313,8 +21789,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -21365,8 +21841,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -21383,7 +21859,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -21411,7 +21891,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -21444,7 +21924,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -21466,7 +21946,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -21513,7 +21993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -21535,8 +22019,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -21552,7 +22036,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -21560,13 +22048,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -21749,8 +22241,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -21792,8 +22284,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -21813,8 +22305,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -21824,7 +22316,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -21948,13 +22444,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -21962,8 +22458,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -22053,8 +22549,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -22146,7 +22642,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -22396,13 +22896,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -22505,7 +23005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -22526,8 +23030,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -22536,8 +23040,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -22569,8 +23073,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -22621,8 +23125,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -22639,7 +23143,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -22667,7 +23175,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -22700,7 +23208,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -22722,7 +23230,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -22769,7 +23277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -22791,8 +23303,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -22808,7 +23320,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -22816,13 +23332,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -23005,8 +23525,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -23048,8 +23568,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -23069,8 +23589,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -23080,7 +23600,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -23204,13 +23728,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -23218,8 +23742,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -23309,8 +23833,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -23402,7 +23926,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -23652,13 +24180,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -23761,7 +24289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -23782,8 +24314,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -23792,8 +24324,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -23825,8 +24357,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -23877,8 +24409,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -23895,7 +24427,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -23923,7 +24459,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -23956,7 +24492,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -23978,7 +24514,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -24025,7 +24561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -24047,8 +24587,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -24064,7 +24604,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -24072,13 +24616,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -24261,8 +24809,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -24304,8 +24852,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -24325,8 +24873,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -24336,7 +24884,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -24460,13 +25012,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -24474,8 +25026,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -24565,8 +25117,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -24658,7 +25210,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -24908,13 +25464,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -25017,7 +25573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -25038,8 +25598,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -25048,8 +25608,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -25081,8 +25641,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -25133,8 +25693,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -25151,7 +25711,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -25179,7 +25743,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -25212,7 +25776,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -25234,7 +25798,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -25281,7 +25845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -25303,8 +25871,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -25320,7 +25888,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -25328,13 +25900,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -25517,8 +26093,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -25560,8 +26136,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -25581,8 +26157,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -25592,7 +26168,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -25716,13 +26296,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -25730,8 +26310,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -25821,8 +26401,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -25914,7 +26494,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -26164,13 +26748,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -26273,7 +26857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -26294,8 +26882,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -26304,8 +26892,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -26337,8 +26925,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -26389,8 +26977,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -26407,7 +26995,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -26435,7 +27027,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -26468,7 +27060,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -26490,7 +27082,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -26537,7 +27129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -26559,8 +27155,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -26576,7 +27172,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -26584,13 +27184,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -26773,8 +27377,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -26816,8 +27420,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -26837,8 +27441,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -26848,7 +27452,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -26972,13 +27580,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -26986,8 +27594,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -27077,8 +27685,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -27170,7 +27778,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -27420,13 +28032,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -27529,7 +28141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -27550,8 +28166,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -27560,8 +28176,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -27593,8 +28209,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -27645,8 +28261,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -27663,7 +28279,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -27691,7 +28311,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -27724,7 +28344,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -27746,7 +28366,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -27793,7 +28413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -27815,8 +28439,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -27832,7 +28456,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -27840,13 +28468,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -28029,8 +28661,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -28072,8 +28704,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -28093,8 +28725,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -28104,7 +28736,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -28228,13 +28864,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -28242,8 +28878,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -28333,8 +28969,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -28426,7 +29062,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -28676,13 +29316,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -28785,7 +29425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -28806,8 +29450,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -28816,8 +29460,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -28849,8 +29493,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -28901,8 +29545,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -28919,7 +29563,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -28947,7 +29595,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -28980,7 +29628,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -29002,7 +29650,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -29049,7 +29697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -29071,8 +29723,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -29088,7 +29740,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -29096,13 +29752,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -29285,8 +29945,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -29328,8 +29988,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -29349,8 +30009,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -29360,7 +30020,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -29484,13 +30148,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -29498,8 +30162,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -29589,8 +30253,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -29682,7 +30346,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -29932,13 +30600,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -30041,7 +30709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -30062,8 +30734,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -30072,8 +30744,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -30105,8 +30777,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -30157,8 +30829,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -30175,7 +30847,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -30203,7 +30879,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -30236,7 +30912,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -30258,7 +30934,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -30305,7 +30981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -30327,8 +31007,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -30344,7 +31024,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -30352,13 +31036,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -30541,8 +31229,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -30584,8 +31272,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -30605,8 +31293,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -30616,7 +31304,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -30740,13 +31432,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -30754,8 +31446,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -30845,8 +31537,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -30938,7 +31630,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -31188,13 +31884,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -31297,7 +31993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -31318,8 +32018,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -31328,8 +32028,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -31361,8 +32061,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -31413,8 +32113,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -31431,7 +32131,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -31459,7 +32163,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -31492,7 +32196,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -31514,7 +32218,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -31561,7 +32265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -31583,8 +32291,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -31600,7 +32308,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -31608,13 +32320,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -31797,8 +32513,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -31840,8 +32556,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -31861,8 +32577,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -31872,7 +32588,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -31996,13 +32716,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -32010,8 +32730,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -32101,8 +32821,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -32194,7 +32914,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -32444,13 +33168,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -32553,7 +33277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -32574,8 +33302,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -32584,8 +33312,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -32617,8 +33345,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -32669,8 +33397,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -32687,7 +33415,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -32715,7 +33447,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -32748,7 +33480,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -32770,7 +33502,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -32817,7 +33549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -32839,8 +33575,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -32856,7 +33592,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -32864,13 +33604,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -33053,8 +33797,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -33096,8 +33840,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -33117,8 +33861,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -33128,7 +33872,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -33252,13 +34000,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -33266,8 +34014,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -33357,8 +34105,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -33450,7 +34198,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -33700,13 +34452,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -33809,7 +34561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -33830,8 +34586,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -33840,8 +34596,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -33873,8 +34629,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -33925,8 +34681,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -33943,7 +34699,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -33971,7 +34731,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -34004,7 +34764,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -34026,7 +34786,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -34073,7 +34833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -34095,8 +34859,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -34112,7 +34876,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -34120,13 +34888,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -34309,8 +35081,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -34352,8 +35124,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -34373,8 +35145,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -34384,7 +35156,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -34508,13 +35284,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -34522,8 +35298,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -34613,8 +35389,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -34706,7 +35482,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -34956,13 +35736,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -35065,7 +35845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -35086,8 +35870,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -35096,8 +35880,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -35129,8 +35913,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -35181,8 +35965,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -35199,7 +35983,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -35227,7 +36015,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -35260,7 +36048,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -35282,7 +36070,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -35329,7 +36117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -35351,8 +36143,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -35368,7 +36160,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -35376,13 +36172,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -35565,8 +36365,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -35608,8 +36408,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -35629,8 +36429,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -35640,7 +36440,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -35764,13 +36568,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -35778,8 +36582,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -35869,8 +36673,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -35962,7 +36766,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -36212,13 +37020,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -36321,7 +37129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -36342,8 +37154,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -36352,8 +37164,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -36385,8 +37197,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -36437,8 +37249,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -36455,7 +37267,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -36483,7 +37299,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -36516,7 +37332,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -36538,7 +37354,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -36585,7 +37401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -36607,8 +37427,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -36624,7 +37444,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -36632,13 +37456,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -36821,8 +37649,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -36864,8 +37692,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -36885,8 +37713,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -36896,7 +37724,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -37020,13 +37852,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -37034,8 +37866,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -37125,8 +37957,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -37218,7 +38050,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -37468,13 +38304,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -37577,7 +38413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -37598,8 +38438,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -37608,8 +38448,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -37641,8 +38481,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -37693,8 +38533,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -37711,7 +38551,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -37739,7 +38583,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -37772,7 +38616,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -37794,7 +38638,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -37841,7 +38685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -37863,8 +38711,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -37880,7 +38728,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -37888,13 +38740,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -38077,8 +38933,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -38120,8 +38976,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -38141,8 +38997,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -38152,7 +39008,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -38276,13 +39136,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -38290,8 +39150,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -38381,8 +39241,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -38474,7 +39334,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -38724,13 +39588,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -38833,7 +39697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -38854,8 +39722,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -38864,8 +39732,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -38897,8 +39765,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -38949,8 +39817,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -38967,7 +39835,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -38995,7 +39867,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -39028,7 +39900,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -39050,7 +39922,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -39097,7 +39969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -39119,8 +39995,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -39136,7 +40012,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -39144,13 +40024,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -39333,8 +40217,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -39376,8 +40260,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -39397,8 +40281,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -39408,7 +40292,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -39532,13 +40420,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -39546,8 +40434,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -39637,8 +40525,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -39730,7 +40618,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -39980,13 +40872,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -40089,7 +40981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -40110,8 +41006,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -40120,8 +41016,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -40153,8 +41049,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -40205,8 +41101,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -40223,7 +41119,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -40251,7 +41151,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -40284,7 +41184,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -40306,7 +41206,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -40353,7 +41253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -40375,8 +41279,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -40392,7 +41296,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -40400,13 +41308,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -40589,8 +41501,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -40632,8 +41544,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -40653,8 +41565,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -40664,7 +41576,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -40788,13 +41704,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -40802,8 +41718,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -40893,8 +41809,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -40986,7 +41902,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -41236,13 +42156,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -41345,7 +42265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -41366,8 +42290,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -41376,8 +42300,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -41409,8 +42333,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -41461,8 +42385,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -41479,7 +42403,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -41507,7 +42435,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -41540,7 +42468,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -41562,7 +42490,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -41609,7 +42537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -41631,8 +42563,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -41648,7 +42580,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -41656,13 +42592,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -41845,8 +42785,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -41888,8 +42828,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -41909,8 +42849,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -41920,7 +42860,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -42044,13 +42988,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -42058,8 +43002,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -42149,8 +43093,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -42242,7 +43186,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -42492,13 +43440,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -42601,7 +43549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -42622,8 +43574,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -42632,8 +43584,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -42665,8 +43617,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -42717,8 +43669,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -42735,7 +43687,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -42763,7 +43719,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -42796,7 +43752,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -42818,7 +43774,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -42865,7 +43821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -42887,8 +43847,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -42904,7 +43864,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -42912,13 +43876,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -43101,8 +44069,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -43144,8 +44112,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -43165,8 +44133,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -43176,7 +44144,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -43300,13 +44272,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -43314,8 +44286,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -43405,8 +44377,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -43498,7 +44470,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -43748,13 +44724,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -43857,7 +44833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -43878,8 +44858,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -43888,8 +44868,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -43921,8 +44901,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -43973,8 +44953,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -43991,7 +44971,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -44019,7 +45003,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -44052,7 +45036,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -44074,7 +45058,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -44121,7 +45105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -44143,8 +45131,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -44160,7 +45148,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -44168,13 +45160,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -44357,8 +45353,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -44400,8 +45396,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -44421,8 +45417,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -44432,7 +45428,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -44556,13 +45556,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -44570,8 +45570,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -44661,8 +45661,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -44754,7 +45754,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -45004,13 +46008,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -45113,7 +46117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -45134,8 +46142,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -45144,8 +46152,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -45177,8 +46185,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -45229,8 +46237,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -45247,7 +46255,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -45275,7 +46287,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -45308,7 +46320,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -45330,7 +46342,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -45377,7 +46389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -45399,8 +46415,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -45416,7 +46432,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -45424,13 +46444,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -45613,8 +46637,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -45656,8 +46680,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -45677,8 +46701,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -45688,7 +46712,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -45812,13 +46840,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -45826,8 +46854,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -45917,8 +46945,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -46010,7 +47038,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -46260,13 +47292,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -46369,7 +47401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -46390,8 +47426,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -46400,8 +47436,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -46433,8 +47469,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -46485,8 +47521,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -46503,7 +47539,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -46531,7 +47571,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -46564,7 +47604,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -46586,7 +47626,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -46633,7 +47673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -46655,8 +47699,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -46672,7 +47716,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -46680,13 +47728,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -46869,8 +47921,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -46912,8 +47964,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -46933,8 +47985,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -46944,7 +47996,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -47068,13 +48124,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -47082,8 +48138,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -47173,8 +48229,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -47266,7 +48322,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -47516,13 +48576,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -47625,7 +48685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -47646,8 +48710,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -47656,8 +48720,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -47689,8 +48753,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -47741,8 +48805,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -47759,7 +48823,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -47787,7 +48855,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -47820,7 +48888,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -47842,7 +48910,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -47889,7 +48957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -47911,8 +48983,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -47928,7 +49000,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -47936,13 +49012,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -48125,8 +49205,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -48168,8 +49248,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -48189,8 +49269,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -48200,7 +49280,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -48324,13 +49408,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -48338,8 +49422,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -48429,8 +49513,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -48522,7 +49606,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -48772,13 +49860,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -48881,7 +49969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -48902,8 +49994,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -48912,8 +50004,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -48945,8 +50037,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -48997,8 +50089,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -49015,7 +50107,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -49043,7 +50139,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -49076,7 +50172,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -49098,7 +50194,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -49145,7 +50241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -49167,8 +50267,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -49184,7 +50284,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -49192,13 +50296,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -49381,8 +50489,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -49424,8 +50532,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -49445,8 +50553,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -49456,7 +50564,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -49580,13 +50692,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -49594,8 +50706,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -49685,8 +50797,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -49778,7 +50890,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -50028,13 +51144,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -50137,7 +51253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -50158,8 +51278,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -50168,8 +51288,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -50201,8 +51321,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -50253,8 +51373,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -50271,7 +51391,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -50299,7 +51423,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -50332,7 +51456,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -50354,7 +51478,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -50401,7 +51525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -50423,8 +51551,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -50440,7 +51568,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -50448,13 +51580,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -50637,8 +51773,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -50680,8 +51816,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -50701,8 +51837,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -50712,7 +51848,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -50836,13 +51976,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -50850,8 +51990,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -50941,8 +52081,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -51034,7 +52174,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -51284,13 +52428,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -51393,7 +52537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -51414,8 +52562,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -51424,8 +52572,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -51457,8 +52605,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -51509,8 +52657,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -51527,7 +52675,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -51555,7 +52707,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -51588,7 +52740,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -51610,7 +52762,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -51657,7 +52809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -51679,8 +52835,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -51696,7 +52852,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -51704,13 +52864,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -51893,8 +53057,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -51936,8 +53100,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -51957,8 +53121,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -51968,7 +53132,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -52092,13 +53260,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -52106,8 +53274,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -52197,8 +53365,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -52290,7 +53458,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -52540,13 +53712,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -52649,7 +53821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -52670,8 +53846,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -52680,8 +53856,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -52713,8 +53889,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -52765,8 +53941,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -52783,7 +53959,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -52811,7 +53991,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -52844,7 +54024,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -52866,7 +54046,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -52913,7 +54093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -52935,8 +54119,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -52952,7 +54136,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -52960,13 +54148,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -53149,8 +54341,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -53192,8 +54384,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -53213,8 +54405,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -53224,7 +54416,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -53348,13 +54544,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -53362,8 +54558,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -53453,8 +54649,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -53546,7 +54742,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -53796,13 +54996,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -53905,7 +55105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -53926,8 +55130,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -53936,8 +55140,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -53969,8 +55173,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -54021,8 +55225,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -54039,7 +55243,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -54067,7 +55275,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -54100,7 +55308,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -54122,7 +55330,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -54169,7 +55377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -54191,8 +55403,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -54208,7 +55420,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -54216,13 +55432,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -54405,8 +55625,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -54448,8 +55668,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -54469,8 +55689,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -54480,7 +55700,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -54604,13 +55828,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -54618,8 +55842,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -54709,8 +55933,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -54802,7 +56026,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -55052,13 +56280,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -55161,7 +56389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -55182,8 +56414,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -55192,8 +56424,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -55225,8 +56457,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -55277,8 +56509,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -55295,7 +56527,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -55323,7 +56559,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -55356,7 +56592,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -55378,7 +56614,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -55425,7 +56661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -55447,8 +56687,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -55464,7 +56704,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -55472,13 +56716,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -55661,8 +56909,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -55704,8 +56952,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -55725,8 +56973,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -55736,7 +56984,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -55860,13 +57112,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -55874,8 +57126,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -55965,8 +57217,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -56058,7 +57310,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -56308,13 +57564,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -56417,7 +57673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -56438,8 +57698,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -56448,8 +57708,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -56481,8 +57741,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -56533,8 +57793,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -56551,7 +57811,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -56579,7 +57843,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -56612,7 +57876,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -56634,7 +57898,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -56681,7 +57945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -56703,8 +57971,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -56720,7 +57988,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -56728,13 +58000,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -56917,8 +58193,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -56960,8 +58236,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -56981,8 +58257,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -56992,7 +58268,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -57116,13 +58396,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -57130,8 +58410,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -57221,8 +58501,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -57314,7 +58594,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -57564,13 +58848,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -57673,7 +58957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -57694,8 +58982,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -57704,8 +58992,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -57737,8 +59025,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -57789,8 +59077,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -57807,7 +59095,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -57835,7 +59127,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -57868,7 +59160,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -57890,7 +59182,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -57937,7 +59229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -57959,8 +59255,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -57976,7 +59272,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -57984,13 +59284,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -58173,8 +59477,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -58216,8 +59520,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -58237,8 +59541,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -58248,7 +59552,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -58372,13 +59680,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -58386,8 +59694,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -58477,8 +59785,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -58570,7 +59878,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -58820,13 +60132,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -58929,7 +60241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -58950,8 +60266,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -58960,8 +60276,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -58993,8 +60309,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -59045,8 +60361,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -59063,7 +60379,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -59091,7 +60411,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -59124,7 +60444,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -59146,7 +60466,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -59193,7 +60513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -59215,8 +60539,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -59232,7 +60556,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -59240,13 +60568,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -59429,8 +60761,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -59472,8 +60804,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -59493,8 +60825,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -59504,7 +60836,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -59628,13 +60964,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -59642,8 +60978,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -59733,8 +61069,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -59826,7 +61162,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -60076,13 +61416,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -60185,7 +61525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -60206,8 +61550,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -60216,8 +61560,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -60249,8 +61593,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -60301,8 +61645,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -60319,7 +61663,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -60347,7 +61695,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -60380,7 +61728,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -60402,7 +61750,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -60449,7 +61797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -60471,8 +61823,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -60488,7 +61840,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -60496,13 +61852,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -60685,8 +62045,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -60728,8 +62088,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -60749,8 +62109,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -60760,7 +62120,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -60884,13 +62248,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -60898,8 +62262,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -60989,8 +62353,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -61082,7 +62446,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -61332,13 +62700,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -61441,7 +62809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -61462,8 +62834,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -61472,8 +62844,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -61505,8 +62877,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -61557,8 +62929,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -61575,7 +62947,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -61603,7 +62979,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -61636,7 +63012,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -61658,7 +63034,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -61705,7 +63081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -61727,8 +63107,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -61744,7 +63124,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -61752,13 +63136,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -61941,8 +63329,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -61984,8 +63372,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -62005,8 +63393,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -62016,7 +63404,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -62140,13 +63532,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -62154,8 +63546,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -62245,8 +63637,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -62338,7 +63730,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -62588,13 +63984,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -62697,7 +64093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -62718,8 +64118,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -62728,8 +64128,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -62761,8 +64161,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -62813,8 +64213,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -62831,7 +64231,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -62859,7 +64263,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -62892,7 +64296,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -62914,7 +64318,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -62961,7 +64365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -62983,8 +64391,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -63000,7 +64408,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -63008,13 +64420,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -63197,8 +64613,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -63240,8 +64656,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -63261,8 +64677,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -63272,7 +64688,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -63396,13 +64816,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -63410,8 +64830,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -63501,8 +64921,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -63594,7 +65014,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -63844,13 +65268,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -63953,7 +65377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -63974,8 +65402,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -63984,8 +65412,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -64017,8 +65445,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -64069,8 +65497,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -64087,7 +65515,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -64115,7 +65547,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -64148,7 +65580,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -64170,7 +65602,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -64217,7 +65649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -64239,8 +65675,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -64256,7 +65692,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -64264,13 +65704,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -64453,8 +65897,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -64496,8 +65940,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -64517,8 +65961,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -64528,7 +65972,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -64652,13 +66100,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -64666,8 +66114,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -64757,8 +66205,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -64850,7 +66298,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -65100,13 +66552,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -65209,7 +66661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -65230,8 +66686,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -65240,8 +66696,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -65273,8 +66729,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -65325,8 +66781,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -65343,7 +66799,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -65371,7 +66831,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -65404,7 +66864,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -65426,7 +66886,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -65473,7 +66933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -65495,8 +66959,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -65512,7 +66976,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -65520,13 +66988,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -65709,8 +67181,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -65752,8 +67224,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -65773,8 +67245,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -65784,7 +67256,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -65908,13 +67384,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -65922,8 +67398,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -66013,8 +67489,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -66106,7 +67582,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -66356,13 +67836,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -66465,7 +67945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -66486,8 +67970,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -66496,8 +67980,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -66529,8 +68013,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -66581,8 +68065,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -66599,7 +68083,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -66627,7 +68115,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -66660,7 +68148,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -66682,7 +68170,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -66729,7 +68217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -66751,8 +68243,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -66768,7 +68260,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -66776,13 +68272,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -66965,8 +68465,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -67008,8 +68508,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -67029,8 +68529,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -67040,7 +68540,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -67164,13 +68668,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -67178,8 +68682,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -67269,8 +68773,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -67362,7 +68866,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -67612,13 +69120,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -67721,7 +69229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -67742,8 +69254,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -67752,8 +69264,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -67785,8 +69297,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -67837,8 +69349,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -67855,7 +69367,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -67883,7 +69399,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -67916,7 +69432,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -67938,7 +69454,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -67985,7 +69501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -68007,8 +69527,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -68024,7 +69544,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -68032,13 +69556,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -68221,8 +69749,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -68264,8 +69792,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -68285,8 +69813,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -68296,7 +69824,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -68420,13 +69952,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -68434,8 +69966,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -68525,8 +70057,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -68618,7 +70150,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -68868,13 +70404,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -68977,7 +70513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -68998,8 +70538,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -69008,8 +70548,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -69041,8 +70581,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -69093,8 +70633,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -69111,7 +70651,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -69139,7 +70683,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -69172,7 +70716,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -69194,7 +70738,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -69241,7 +70785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -69263,8 +70811,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -69280,7 +70828,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -69288,13 +70840,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -69477,8 +71033,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -69520,8 +71076,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -69541,8 +71097,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -69552,7 +71108,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -69676,13 +71236,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -69690,8 +71250,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -69781,8 +71341,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -69874,7 +71434,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -70124,13 +71688,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -70233,7 +71797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -70254,8 +71822,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -70264,8 +71832,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -70297,8 +71865,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -70349,8 +71917,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -70367,7 +71935,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -70395,7 +71967,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -70428,7 +72000,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -70450,7 +72022,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -70497,7 +72069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -70519,8 +72095,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -70536,7 +72112,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -70544,13 +72124,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -70733,8 +72317,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -70776,8 +72360,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -70797,8 +72381,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -70808,7 +72392,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -70932,13 +72520,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -70946,8 +72534,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -71037,8 +72625,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -71130,7 +72718,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -71380,13 +72972,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -71489,7 +73081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -71510,8 +73106,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -71520,8 +73116,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -71553,8 +73149,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -71605,8 +73201,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -71623,7 +73219,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -71651,7 +73251,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -71684,7 +73284,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -71706,7 +73306,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -71753,7 +73353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -71775,8 +73379,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -71792,7 +73396,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -71800,13 +73408,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -71989,8 +73601,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -72032,8 +73644,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -72053,8 +73665,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -72064,7 +73676,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -72188,13 +73804,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -72202,8 +73818,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -72293,8 +73909,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -72386,7 +74002,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -72636,13 +74256,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -72745,7 +74365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -72766,8 +74390,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -72776,8 +74400,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -72809,8 +74433,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -72861,8 +74485,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -72879,7 +74503,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -72907,7 +74535,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -72940,7 +74568,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -72962,7 +74590,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -73009,7 +74637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -73031,8 +74663,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -73048,7 +74680,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -73056,13 +74692,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -73245,8 +74885,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -73288,8 +74928,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -73309,8 +74949,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -73320,7 +74960,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -73444,13 +75088,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -73458,8 +75102,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -73549,8 +75193,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -73642,7 +75286,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -73892,13 +75540,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -74001,7 +75649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -74022,8 +75674,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -74032,8 +75684,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -74065,8 +75717,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -74117,8 +75769,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -74135,7 +75787,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -74163,7 +75819,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -74196,7 +75852,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -74218,7 +75874,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -74265,7 +75921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -74287,8 +75947,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -74304,7 +75964,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -74312,13 +75976,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -74501,8 +76169,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -74544,8 +76212,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -74565,8 +76233,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -74576,7 +76244,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -74700,13 +76372,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -74714,8 +76386,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -74805,8 +76477,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -74898,7 +76570,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -75148,13 +76824,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -75257,7 +76933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -75278,8 +76958,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -75288,8 +76968,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -75321,8 +77001,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -75373,8 +77053,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -75391,7 +77071,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -75419,7 +77103,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -75452,7 +77136,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -75474,7 +77158,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -75521,7 +77205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -75543,8 +77231,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -75560,7 +77248,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -75568,13 +77260,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -75757,8 +77453,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -75800,8 +77496,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -75821,8 +77517,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -75832,7 +77528,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -75956,13 +77656,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -75970,8 +77670,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -76061,8 +77761,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -76154,7 +77854,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -76404,13 +78108,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -76513,7 +78217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -76534,8 +78242,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -76544,8 +78252,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -76577,8 +78285,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -76629,8 +78337,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -76647,7 +78355,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -76675,7 +78387,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -76708,7 +78420,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -76730,7 +78442,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -76777,7 +78489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -76799,8 +78515,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -76816,7 +78532,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -76824,13 +78544,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -77013,8 +78737,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -77056,8 +78780,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -77077,8 +78801,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -77088,7 +78812,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -77212,13 +78940,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -77226,8 +78954,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -77317,8 +79045,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -77410,7 +79138,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -77660,13 +79392,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -77769,7 +79501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -77790,8 +79526,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -77800,8 +79536,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -77833,8 +79569,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -77885,8 +79621,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -77903,7 +79639,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -77931,7 +79671,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -77964,7 +79704,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -77986,7 +79726,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -78033,7 +79773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -78055,8 +79799,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -78072,7 +79816,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -78080,13 +79828,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -78269,8 +80021,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -78312,8 +80064,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -78333,8 +80085,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -78344,7 +80096,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -78468,13 +80224,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -78482,8 +80238,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -78573,8 +80329,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -78666,7 +80422,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -78916,13 +80676,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -79025,7 +80785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -79046,8 +80810,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -79056,8 +80820,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -79089,8 +80853,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -79141,8 +80905,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -79159,7 +80923,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -79187,7 +80955,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -79220,7 +80988,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -79242,7 +81010,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -79289,7 +81057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -79311,8 +81083,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -79328,7 +81100,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -79336,13 +81112,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -79525,8 +81305,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -79568,8 +81348,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -79589,8 +81369,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -79600,7 +81380,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -79724,13 +81508,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -79738,8 +81522,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -79829,8 +81613,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -79922,7 +81706,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -80172,13 +81960,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -80281,7 +82069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -80302,8 +82094,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -80312,8 +82104,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -80345,8 +82137,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -80397,8 +82189,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -80415,7 +82207,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -80443,7 +82239,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -80476,7 +82272,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -80498,7 +82294,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -80545,7 +82341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -80567,8 +82367,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -80584,7 +82384,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -80592,13 +82396,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -80781,8 +82589,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -80824,8 +82632,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -80845,8 +82653,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -80856,7 +82664,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -80980,13 +82792,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -80994,8 +82806,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -81085,8 +82897,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -81178,7 +82990,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -81428,13 +83244,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -81537,7 +83353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -81558,8 +83378,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -81568,8 +83388,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -81601,8 +83421,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -81653,8 +83473,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -81671,7 +83491,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -81699,7 +83523,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -81732,7 +83556,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -81754,7 +83578,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -81801,7 +83625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -81823,8 +83651,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -81840,7 +83668,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -81848,13 +83680,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -82037,8 +83873,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -82080,8 +83916,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -82101,8 +83937,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -82112,7 +83948,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -82236,13 +84076,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -82250,8 +84090,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -82341,8 +84181,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -82434,7 +84274,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -82684,13 +84528,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -82793,7 +84637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -82814,8 +84662,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -82824,8 +84672,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -82857,8 +84705,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -82909,8 +84757,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -82927,7 +84775,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -82955,7 +84807,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -82988,7 +84840,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -83010,7 +84862,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -83057,7 +84909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -83079,8 +84935,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -83096,7 +84952,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -83104,13 +84964,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -83293,8 +85157,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -83336,8 +85200,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -83357,8 +85221,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -83368,7 +85232,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -83492,13 +85360,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -83506,8 +85374,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -83597,8 +85465,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -83690,7 +85558,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -83940,13 +85812,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -84049,7 +85921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -84070,8 +85946,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -84080,8 +85956,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -84113,8 +85989,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -84165,8 +86041,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -84183,7 +86059,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -84211,7 +86091,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -84244,7 +86124,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -84266,7 +86146,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -84313,7 +86193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -84335,8 +86219,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -84352,7 +86236,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -84360,13 +86248,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -84549,8 +86441,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -84592,8 +86484,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -84613,8 +86505,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -84624,7 +86516,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -84748,13 +86644,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -84762,8 +86658,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -84853,8 +86749,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -84946,7 +86842,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -85196,13 +87096,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -85305,7 +87205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -85326,8 +87230,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -85336,8 +87240,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -85369,8 +87273,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -85421,8 +87325,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -85439,7 +87343,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -85467,7 +87375,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -85500,7 +87408,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -85522,7 +87430,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -85569,7 +87477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -85591,8 +87503,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -85608,7 +87520,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -85616,13 +87532,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -85805,8 +87725,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -85848,8 +87768,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -85869,8 +87789,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -85880,7 +87800,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -86004,13 +87928,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -86018,8 +87942,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -86109,8 +88033,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -86202,7 +88126,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -86452,13 +88380,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -86561,7 +88489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -86582,8 +88514,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -86592,8 +88524,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -86625,8 +88557,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -86677,8 +88609,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -86695,7 +88627,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -86723,7 +88659,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -86756,7 +88692,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -86778,7 +88714,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -86825,7 +88761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -86847,8 +88787,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -86864,7 +88804,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -86872,13 +88816,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -87061,8 +89009,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -87104,8 +89052,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -87125,8 +89073,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -87136,7 +89084,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -87260,13 +89212,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -87274,8 +89226,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -87365,8 +89317,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -87458,7 +89410,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -87708,13 +89664,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -87817,7 +89773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -87838,8 +89798,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -87848,8 +89808,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -87881,8 +89841,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -87933,8 +89893,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -87951,7 +89911,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -87979,7 +89943,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -88012,7 +89976,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -88034,7 +89998,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -88081,7 +90045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -88103,8 +90071,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -88120,7 +90088,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -88128,13 +90100,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -88317,8 +90293,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -88360,8 +90336,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -88381,8 +90357,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -88392,7 +90368,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -88516,13 +90496,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -88530,8 +90510,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -88621,8 +90601,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -88714,7 +90694,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -88964,13 +90948,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -89073,7 +91057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -89094,8 +91082,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -89104,8 +91092,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -89137,8 +91125,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -89189,8 +91177,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -89207,7 +91195,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -89235,7 +91227,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -89268,7 +91260,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -89290,7 +91282,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -89337,7 +91329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -89359,8 +91355,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -89376,7 +91372,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -89384,13 +91384,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -89573,8 +91577,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -89616,8 +91620,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -89637,8 +91641,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -89648,7 +91652,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -89772,13 +91780,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -89786,8 +91794,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -89877,8 +91885,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -89970,7 +91978,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -90220,13 +92232,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -90329,7 +92341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -90350,8 +92366,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -90360,8 +92376,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -90393,8 +92409,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -90445,8 +92461,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -90463,7 +92479,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -90491,7 +92511,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -90524,7 +92544,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -90546,7 +92566,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -90593,7 +92613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -90615,8 +92639,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -90632,7 +92656,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -90640,13 +92668,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -90829,8 +92861,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -90872,8 +92904,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -90893,8 +92925,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -90904,7 +92936,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -91028,13 +93064,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -91042,8 +93078,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -91133,8 +93169,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -91226,7 +93262,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -91476,13 +93516,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -91585,7 +93625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -91606,8 +93650,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -91616,8 +93660,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -91649,8 +93693,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -91701,8 +93745,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -91719,7 +93763,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -91747,7 +93795,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -91780,7 +93828,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -91802,7 +93850,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -91849,7 +93897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -91871,8 +93923,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -91888,7 +93940,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -91896,13 +93952,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -92085,8 +94145,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -92128,8 +94188,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -92149,8 +94209,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -92160,7 +94220,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -92284,13 +94348,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -92298,8 +94362,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -92389,8 +94453,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -92482,7 +94546,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -92732,13 +94800,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -92841,7 +94909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -92862,8 +94934,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -92872,8 +94944,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -92905,8 +94977,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -92957,8 +95029,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -92975,7 +95047,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -93003,7 +95079,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -93036,7 +95112,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -93058,7 +95134,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -93105,7 +95181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -93127,8 +95207,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -93144,7 +95224,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -93152,13 +95236,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -93341,8 +95429,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -93384,8 +95472,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -93405,8 +95493,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -93416,7 +95504,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -93540,13 +95632,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -93554,8 +95646,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -93645,8 +95737,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -93738,7 +95830,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -93988,13 +96084,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -94097,7 +96193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -94118,8 +96218,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -94128,8 +96228,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -94161,8 +96261,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -94213,8 +96313,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -94231,7 +96331,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -94259,7 +96363,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -94292,7 +96396,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -94314,7 +96418,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -94361,7 +96465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -94383,8 +96491,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -94400,7 +96508,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -94408,13 +96520,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -94597,8 +96713,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -94640,8 +96756,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -94661,8 +96777,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -94672,7 +96788,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -94796,13 +96916,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -94810,8 +96930,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -94901,8 +97021,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -94994,7 +97114,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -95244,13 +97368,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -95353,7 +97477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -95374,8 +97502,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -95384,8 +97512,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -95417,8 +97545,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -95469,8 +97597,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -95487,7 +97615,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -95515,7 +97647,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -95548,7 +97680,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -95570,7 +97702,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -95617,7 +97749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -95639,8 +97775,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -95656,7 +97792,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -95664,13 +97804,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -95853,8 +97997,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -95896,8 +98040,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -95917,8 +98061,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -95928,7 +98072,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -96052,13 +98200,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -96066,8 +98214,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -96157,8 +98305,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -96250,7 +98398,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -96500,13 +98652,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -96609,7 +98761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -96630,8 +98786,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -96640,8 +98796,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -96673,8 +98829,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -96725,8 +98881,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -96743,7 +98899,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -96771,7 +98931,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -96804,7 +98964,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -96826,7 +98986,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -96873,7 +99033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -96895,8 +99059,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -96912,7 +99076,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -96920,13 +99088,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -97109,8 +99281,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -97152,8 +99324,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -97173,8 +99345,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -97184,7 +99356,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -97308,13 +99484,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -97322,8 +99498,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -97413,8 +99589,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -97506,7 +99682,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -97756,13 +99936,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -97865,7 +100045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -97886,8 +100070,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -97896,8 +100080,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -97929,8 +100113,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -97981,8 +100165,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -97999,7 +100183,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -98027,7 +100215,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -98060,7 +100248,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -98082,7 +100270,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -98129,7 +100317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -98151,8 +100343,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -98168,7 +100360,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -98176,13 +100372,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -98365,8 +100565,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -98408,8 +100608,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -98429,8 +100629,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -98440,7 +100640,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -98564,13 +100768,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -98578,8 +100782,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -98669,8 +100873,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -98762,7 +100966,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -99012,13 +101220,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -99121,7 +101329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -99142,8 +101354,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -99152,8 +101364,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -99185,8 +101397,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -99237,8 +101449,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -99255,7 +101467,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -99283,7 +101499,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -99316,7 +101532,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -99338,7 +101554,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -99385,7 +101601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -99407,8 +101627,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -99424,7 +101644,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -99432,13 +101656,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -99621,8 +101849,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -99664,8 +101892,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -99685,8 +101913,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -99696,7 +101924,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -99820,13 +102052,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -99834,8 +102066,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -99925,8 +102157,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -100018,7 +102250,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -100268,13 +102504,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -100377,7 +102613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -100398,8 +102638,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -100408,8 +102648,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -100441,8 +102681,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -100493,8 +102733,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -100511,7 +102751,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -100539,7 +102783,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -100572,7 +102816,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -100594,7 +102838,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -100641,7 +102885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -100663,8 +102911,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -100680,7 +102928,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -100688,13 +102940,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -100877,8 +103133,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -100920,8 +103176,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -100941,8 +103197,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -100952,7 +103208,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -101076,13 +103336,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -101090,8 +103350,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -101181,8 +103441,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -101274,7 +103534,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -101524,13 +103788,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -101633,7 +103897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -101654,8 +103922,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -101664,8 +103932,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -101697,8 +103965,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -101749,8 +104017,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -101767,7 +104035,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -101795,7 +104067,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -101828,7 +104100,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -101850,7 +104122,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -101897,7 +104169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -101919,8 +104195,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -101936,7 +104212,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -101944,13 +104224,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -102133,8 +104417,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -102176,8 +104460,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -102197,8 +104481,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -102208,7 +104492,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -102332,13 +104620,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -102346,8 +104634,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -102437,8 +104725,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -102530,7 +104818,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -102780,13 +105072,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -102889,7 +105181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -102910,8 +105206,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -102920,8 +105216,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -102953,8 +105249,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -103005,8 +105301,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -103023,7 +105319,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -103051,7 +105351,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -103084,7 +105384,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -103106,7 +105406,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -103153,7 +105453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -103175,8 +105479,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -103192,7 +105496,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -103200,13 +105508,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -103389,8 +105701,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -103432,8 +105744,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -103453,8 +105765,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -103464,7 +105776,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -103588,13 +105904,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -103602,8 +105918,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -103693,8 +106009,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -103786,7 +106102,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -104036,13 +106356,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -104145,7 +106465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -104166,8 +106490,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -104176,8 +106500,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -104209,8 +106533,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -104261,8 +106585,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -104279,7 +106603,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -104307,7 +106635,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -104340,7 +106668,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -104362,7 +106690,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -104409,7 +106737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -104431,8 +106763,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -104448,7 +106780,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -104456,13 +106792,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -104645,8 +106985,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -104688,8 +107028,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -104709,8 +107049,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -104720,7 +107060,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -104844,13 +107188,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -104858,8 +107202,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -104949,8 +107293,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -105042,7 +107386,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -105292,13 +107640,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -105401,7 +107749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -105422,8 +107774,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -105432,8 +107784,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -105465,8 +107817,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -105517,8 +107869,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -105535,7 +107887,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -105563,7 +107919,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -105596,7 +107952,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -105618,7 +107974,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -105665,7 +108021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -105687,8 +108047,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -105704,7 +108064,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -105712,13 +108076,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -105901,8 +108269,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -105944,8 +108312,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -105965,8 +108333,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -105976,7 +108344,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -106100,13 +108472,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -106114,8 +108486,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -106205,8 +108577,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -106298,7 +108670,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -106548,13 +108924,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -106657,7 +109033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -106678,8 +109058,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -106688,8 +109068,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -106721,8 +109101,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -106773,8 +109153,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -106791,7 +109171,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -106819,7 +109203,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -106852,7 +109236,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -106874,7 +109258,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -106921,7 +109305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -106943,8 +109331,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -106960,7 +109348,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -106968,13 +109360,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -107157,8 +109553,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -107200,8 +109596,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -107221,8 +109617,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -107232,7 +109628,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -107356,13 +109756,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -107370,8 +109770,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -107461,8 +109861,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -107554,7 +109954,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -107804,13 +110208,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -107913,7 +110317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -107934,8 +110342,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -107944,8 +110352,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -107977,8 +110385,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -108029,8 +110437,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -108047,7 +110455,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -108075,7 +110487,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -108108,7 +110520,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -108130,7 +110542,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -108177,7 +110589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -108199,8 +110615,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -108216,7 +110632,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -108224,13 +110644,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -108413,8 +110837,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -108456,8 +110880,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -108477,8 +110901,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -108488,7 +110912,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -108612,13 +111040,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -108626,8 +111054,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -108717,8 +111145,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -108810,7 +111238,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -109060,13 +111492,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -109169,7 +111601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -109190,8 +111626,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -109200,8 +111636,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -109233,8 +111669,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -109285,8 +111721,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -109303,7 +111739,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -109331,7 +111771,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -109364,7 +111804,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -109386,7 +111826,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -109433,7 +111873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -109455,8 +111899,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -109472,7 +111916,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -109480,13 +111928,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -109669,8 +112121,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -109712,8 +112164,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -109733,8 +112185,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -109744,7 +112196,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -109868,13 +112324,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -109882,8 +112338,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -109973,8 +112429,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -110066,7 +112522,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -110316,13 +112776,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -110425,7 +112885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -110446,8 +112910,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -110456,8 +112920,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -110489,8 +112953,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -110541,8 +113005,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -110559,7 +113023,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -110587,7 +113055,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -110620,7 +113088,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -110642,7 +113110,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -110689,7 +113157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -110711,8 +113183,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -110728,7 +113200,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -110736,13 +113212,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -110925,8 +113405,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -110968,8 +113448,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -110989,8 +113469,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -111000,7 +113480,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -111124,13 +113608,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -111138,8 +113622,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -111229,8 +113713,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -111322,7 +113806,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -111572,13 +114060,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -111681,7 +114169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -111702,8 +114194,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -111712,8 +114204,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -111745,8 +114237,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -111797,8 +114289,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -111815,7 +114307,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -111843,7 +114339,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -111876,7 +114372,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -111898,7 +114394,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -111945,7 +114441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -111967,8 +114467,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -111984,7 +114484,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -111992,13 +114496,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -112181,8 +114689,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -112224,8 +114732,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -112245,8 +114753,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -112256,7 +114764,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -112380,13 +114892,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -112394,8 +114906,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -112485,8 +114997,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -112578,7 +115090,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -112828,13 +115344,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -112937,7 +115453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -112958,8 +115478,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -112968,8 +115488,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -113001,8 +115521,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -113053,8 +115573,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -113071,7 +115591,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -113099,7 +115623,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -113132,7 +115656,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -113154,7 +115678,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -113201,7 +115725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -113223,8 +115751,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -113240,7 +115768,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -113248,13 +115780,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -113437,8 +115973,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -113480,8 +116016,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -113501,8 +116037,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -113512,7 +116048,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -113636,13 +116176,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -113650,8 +116190,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -113741,8 +116281,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -113834,7 +116374,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -114084,13 +116628,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -114193,7 +116737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -114214,8 +116762,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -114224,8 +116772,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -114257,8 +116805,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -114309,8 +116857,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -114327,7 +116875,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -114355,7 +116907,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -114388,7 +116940,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -114410,7 +116962,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -114457,7 +117009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -114479,8 +117035,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -114496,7 +117052,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -114504,13 +117064,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -114693,8 +117257,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -114736,8 +117300,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -114757,8 +117321,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -114768,7 +117332,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -114892,13 +117460,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -114906,8 +117474,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -114997,8 +117565,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -115090,7 +117658,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -115340,13 +117912,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -115449,7 +118021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -115470,8 +118046,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -115480,8 +118056,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -115513,8 +118089,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -115565,8 +118141,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -115583,7 +118159,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -115611,7 +118191,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -115644,7 +118224,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -115666,7 +118246,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -115713,7 +118293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -115735,8 +118319,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -115752,7 +118336,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -115760,13 +118348,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -115949,8 +118541,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -115992,8 +118584,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -116013,8 +118605,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -116024,7 +118616,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -116148,13 +118744,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -116162,8 +118758,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -116253,8 +118849,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -116346,7 +118942,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -116596,13 +119196,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -116705,7 +119305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -116726,8 +119330,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -116736,8 +119340,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -116769,8 +119373,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -116821,8 +119425,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -116839,7 +119443,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -116867,7 +119475,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -116900,7 +119508,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -116922,7 +119530,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -116969,7 +119577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -116991,8 +119603,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -117008,7 +119620,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -117016,13 +119632,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -117205,8 +119825,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -117248,8 +119868,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -117269,8 +119889,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -117280,7 +119900,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -117404,13 +120028,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -117418,8 +120042,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -117509,8 +120133,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -117602,7 +120226,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -117852,13 +120480,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -117961,7 +120589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -117982,8 +120614,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -117992,8 +120624,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -118025,8 +120657,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -118077,8 +120709,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -118095,7 +120727,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -118123,7 +120759,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -118156,7 +120792,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -118178,7 +120814,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -118225,7 +120861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -118247,8 +120887,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -118264,7 +120904,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -118272,13 +120916,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -118461,8 +121109,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -118504,8 +121152,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -118525,8 +121173,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -118536,7 +121184,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -118660,13 +121312,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -118674,8 +121326,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -118765,8 +121417,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -118858,7 +121510,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -119108,13 +121764,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -119217,7 +121873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -119238,8 +121898,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -119248,8 +121908,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -119281,8 +121941,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -119333,8 +121993,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -119351,7 +122011,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -119379,7 +122043,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -119412,7 +122076,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -119434,7 +122098,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -119481,7 +122145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -119503,8 +122171,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -119520,7 +122188,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -119528,13 +122200,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -119717,8 +122393,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -119760,8 +122436,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -119781,8 +122457,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -119792,7 +122468,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -119916,13 +122596,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -119930,8 +122610,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -120021,8 +122701,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -120114,7 +122794,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -120364,13 +123048,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -120473,7 +123157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -120494,8 +123182,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -120504,8 +123192,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -120537,8 +123225,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -120589,8 +123277,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -120607,7 +123295,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -120635,7 +123327,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -120668,7 +123360,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -120690,7 +123382,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -120737,7 +123429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -120759,8 +123455,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -120776,7 +123472,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -120784,13 +123484,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -120973,8 +123677,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -121016,8 +123720,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -121037,8 +123741,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -121048,7 +123752,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -121172,13 +123880,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -121186,8 +123894,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -121277,8 +123985,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -121370,7 +124078,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -121620,13 +124332,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -121729,7 +124441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -121750,8 +124466,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -121760,8 +124476,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -121793,8 +124509,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -121845,8 +124561,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -121863,7 +124579,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -121891,7 +124611,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -121924,7 +124644,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -121946,7 +124666,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -121993,7 +124713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -122015,8 +124739,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -122032,7 +124756,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -122040,13 +124768,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -122229,8 +124961,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -122272,8 +125004,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -122293,8 +125025,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -122304,7 +125036,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -122428,13 +125164,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -122442,8 +125178,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -122533,8 +125269,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -122626,7 +125362,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -122876,13 +125616,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -122985,7 +125725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -123006,8 +125750,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -123016,8 +125760,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -123049,8 +125793,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -123101,8 +125845,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -123119,7 +125863,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -123147,7 +125895,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -123180,7 +125928,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -123202,7 +125950,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -123249,7 +125997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -123271,8 +126023,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -123288,7 +126040,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -123296,13 +126052,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -123485,8 +126245,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -123528,8 +126288,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -123549,8 +126309,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -123560,7 +126320,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -123684,13 +126448,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -123698,8 +126462,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -123789,8 +126553,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -123882,7 +126646,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -124132,13 +126900,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -124241,7 +127009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -124262,8 +127034,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -124272,8 +127044,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -124305,8 +127077,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -124357,8 +127129,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -124375,7 +127147,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -124403,7 +127179,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -124436,7 +127212,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -124458,7 +127234,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -124505,7 +127281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -124527,8 +127307,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -124544,7 +127324,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -124552,13 +127336,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -124741,8 +127529,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -124784,8 +127572,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -124805,8 +127593,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -124816,7 +127604,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -124940,13 +127732,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -124954,8 +127746,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -125045,8 +127837,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -125138,7 +127930,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -125388,13 +128184,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -125497,7 +128293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -125518,8 +128318,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -125528,8 +128328,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -125561,8 +128361,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -125613,8 +128413,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -125631,7 +128431,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -125659,7 +128463,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -125692,7 +128496,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -125714,7 +128518,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -125761,7 +128565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -125783,8 +128591,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -125800,7 +128608,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -125808,13 +128620,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -125997,8 +128813,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -126040,8 +128856,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -126061,8 +128877,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -126072,7 +128888,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -126196,13 +129016,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -126210,8 +129030,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -126301,8 +129121,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -126394,7 +129214,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -126644,13 +129468,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -126753,7 +129577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -126774,8 +129602,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -126784,8 +129612,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -126817,8 +129645,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -126869,8 +129697,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -126887,7 +129715,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -126915,7 +129747,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -126948,7 +129780,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -126970,7 +129802,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -127017,7 +129849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -127039,8 +129875,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -127056,7 +129892,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -127064,13 +129904,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -127253,8 +130097,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -127296,8 +130140,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -127317,8 +130161,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -127328,7 +130172,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -127452,13 +130300,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -127466,8 +130314,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -127557,8 +130405,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -127650,7 +130498,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -127900,13 +130752,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -128009,7 +130861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -128030,8 +130886,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -128040,8 +130896,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -128073,8 +130929,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -128125,8 +130981,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -128143,7 +130999,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -128171,7 +131031,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -128204,7 +131064,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -128226,7 +131086,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -128273,7 +131133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -128295,8 +131159,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -128312,7 +131176,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -128320,13 +131188,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -128509,8 +131381,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -128552,8 +131424,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -128573,8 +131445,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -128584,7 +131456,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -128708,13 +131584,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -128722,8 +131598,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -128813,8 +131689,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -128906,7 +131782,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -129156,13 +132036,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -129265,7 +132145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -129286,8 +132170,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -129296,8 +132180,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -129329,8 +132213,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -129381,8 +132265,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -129399,7 +132283,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -129427,7 +132315,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -129460,7 +132348,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -129482,7 +132370,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -129529,7 +132417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -129551,8 +132443,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -129568,7 +132460,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -129576,13 +132472,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -129765,8 +132665,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -129808,8 +132708,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -129829,8 +132729,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -129840,7 +132740,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -129964,13 +132868,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -129978,8 +132882,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -130069,8 +132973,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -130162,7 +133066,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -130412,13 +133320,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -130521,7 +133429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -130542,8 +133454,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -130552,8 +133464,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -130585,8 +133497,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -130637,8 +133549,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -130655,7 +133567,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -130683,7 +133599,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -130716,7 +133632,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -130738,7 +133654,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -130785,7 +133701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -130807,8 +133727,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -130824,7 +133744,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -130832,13 +133756,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -131021,8 +133949,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -131064,8 +133992,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -131085,8 +134013,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -131096,7 +134024,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -131220,13 +134152,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -131234,8 +134166,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -131325,8 +134257,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -131418,7 +134350,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -131668,13 +134604,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -131777,7 +134713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -131798,8 +134738,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -131808,8 +134748,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -131841,8 +134781,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -131893,8 +134833,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -131911,7 +134851,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -131939,7 +134883,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -131972,7 +134916,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -131994,7 +134938,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -132041,7 +134985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -132063,8 +135011,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -132080,7 +135028,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -132088,13 +135040,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -132277,8 +135233,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -132320,8 +135276,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -132341,8 +135297,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -132352,7 +135308,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -132476,13 +135436,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -132490,8 +135450,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -132581,8 +135541,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -132674,7 +135634,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -132924,13 +135888,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -133033,7 +135997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -133054,8 +136022,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -133064,8 +136032,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -133097,8 +136065,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -133149,8 +136117,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -133167,7 +136135,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -133195,7 +136167,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -133228,7 +136200,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -133250,7 +136222,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -133297,7 +136269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -133319,8 +136295,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -133336,7 +136312,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -133344,13 +136324,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -133533,8 +136517,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -133576,8 +136560,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -133597,8 +136581,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -133608,7 +136592,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -133732,13 +136720,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -133746,8 +136734,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -133837,8 +136825,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -133930,7 +136918,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -134180,13 +137172,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -134289,7 +137281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -134310,8 +137306,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -134320,8 +137316,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -134353,8 +137349,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -134405,8 +137401,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -134423,7 +137419,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -134451,7 +137451,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -134484,7 +137484,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -134506,7 +137506,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -134553,7 +137553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -134575,8 +137579,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -134592,7 +137596,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -134600,13 +137608,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -134789,8 +137801,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -134832,8 +137844,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -134853,8 +137865,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -134864,7 +137876,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -134988,13 +138004,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -135002,8 +138018,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -135093,8 +138109,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -135186,7 +138202,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -135436,13 +138456,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -135545,7 +138565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -135566,8 +138590,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -135576,8 +138600,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -135609,8 +138633,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -135661,8 +138685,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -135679,7 +138703,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -135707,7 +138735,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -135740,7 +138768,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -135762,7 +138790,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -135809,7 +138837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -135831,8 +138863,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -135848,7 +138880,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -135856,13 +138892,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -136045,8 +139085,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -136088,8 +139128,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -136109,8 +139149,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -136120,7 +139160,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -136244,13 +139288,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -136258,8 +139302,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -136349,8 +139393,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -136442,7 +139486,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -136692,13 +139740,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -136801,7 +139849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -136822,8 +139874,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -136832,8 +139884,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -136865,8 +139917,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -136917,8 +139969,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -136935,7 +139987,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -136963,7 +140019,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -136996,7 +140052,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -137018,7 +140074,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -137065,7 +140121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -137087,8 +140147,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -137104,7 +140164,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -137112,13 +140176,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -137301,8 +140369,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -137344,8 +140412,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -137365,8 +140433,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -137376,7 +140444,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -137500,13 +140572,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -137514,8 +140586,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -137605,8 +140677,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -137698,7 +140770,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -137948,13 +141024,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -138057,7 +141133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -138078,8 +141158,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -138088,8 +141168,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -138121,8 +141201,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -138173,8 +141253,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -138191,7 +141271,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -138219,7 +141303,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -138252,7 +141336,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -138274,7 +141358,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -138321,7 +141405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -138343,8 +141431,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -138360,7 +141448,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -138368,13 +141460,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -138557,8 +141653,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -138600,8 +141696,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -138621,8 +141717,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -138632,7 +141728,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -138756,13 +141856,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -138770,8 +141870,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -138861,8 +141961,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -138954,7 +142054,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -139204,13 +142308,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -139313,7 +142417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -139334,8 +142442,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -139344,8 +142452,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -139377,8 +142485,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -139429,8 +142537,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -139447,7 +142555,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -139475,7 +142587,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -139508,7 +142620,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -139530,7 +142642,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -139577,7 +142689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -139599,8 +142715,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -139616,7 +142732,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -139624,13 +142744,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -139813,8 +142937,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -139856,8 +142980,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -139877,8 +143001,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -139888,7 +143012,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -140012,13 +143140,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -140026,8 +143154,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -140117,8 +143245,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -140210,7 +143338,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -140460,13 +143592,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -140569,7 +143701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -140590,8 +143726,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -140600,8 +143736,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -140633,8 +143769,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -140685,8 +143821,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -140703,7 +143839,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -140731,7 +143871,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -140764,7 +143904,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -140786,7 +143926,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -140833,7 +143973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -140855,8 +143999,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -140872,7 +144016,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -140880,13 +144028,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -141069,8 +144221,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -141112,8 +144264,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -141133,8 +144285,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -141144,7 +144296,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -141268,13 +144424,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -141282,8 +144438,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -141373,8 +144529,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -141466,7 +144622,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -141716,13 +144876,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -141825,7 +144985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -141846,8 +145010,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -141856,8 +145020,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -141889,8 +145053,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -141941,8 +145105,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -141959,7 +145123,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -141987,7 +145155,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -142020,7 +145188,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -142042,7 +145210,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -142089,7 +145257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -142111,8 +145283,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -142128,7 +145300,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -142136,13 +145312,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -142325,8 +145505,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -142368,8 +145548,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -142389,8 +145569,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -142400,7 +145580,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -142524,13 +145708,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -142538,8 +145722,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -142629,8 +145813,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -142722,7 +145906,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -142972,13 +146160,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -143081,7 +146269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -143102,8 +146294,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -143112,8 +146304,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -143145,8 +146337,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -143197,8 +146389,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -143215,7 +146407,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -143243,7 +146439,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -143276,7 +146472,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -143298,7 +146494,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -143345,7 +146541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -143367,8 +146567,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -143384,7 +146584,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -143392,13 +146596,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -143581,8 +146789,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -143624,8 +146832,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -143645,8 +146853,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -143656,7 +146864,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -143780,13 +146992,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -143794,8 +147006,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -143885,8 +147097,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -143978,7 +147190,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -144228,13 +147444,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -144337,7 +147553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -144358,8 +147578,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -144368,8 +147588,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -144401,8 +147621,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -144453,8 +147673,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -144471,7 +147691,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -144499,7 +147723,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -144532,7 +147756,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -144554,7 +147778,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -144601,7 +147825,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -144623,8 +147851,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -144640,7 +147868,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -144648,13 +147880,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -144837,8 +148073,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -144880,8 +148116,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -144901,8 +148137,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -144912,7 +148148,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -145036,13 +148276,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -145050,8 +148290,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -145141,8 +148381,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -145234,7 +148474,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -145484,13 +148728,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -145593,7 +148837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -145614,8 +148862,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -145624,8 +148872,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -145657,8 +148905,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -145709,8 +148957,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -145727,7 +148975,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -145755,7 +149007,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -145788,7 +149040,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -145810,7 +149062,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -145857,7 +149109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -145879,8 +149135,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -145896,7 +149152,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -145904,13 +149164,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -146093,8 +149357,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -146136,8 +149400,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -146157,8 +149421,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -146168,7 +149432,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -146292,13 +149560,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -146306,8 +149574,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -146397,8 +149665,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -146490,7 +149758,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -146740,13 +150012,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -146849,7 +150121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -146870,8 +150146,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -146880,8 +150156,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -146913,8 +150189,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -146965,8 +150241,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -146983,7 +150259,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -147011,7 +150291,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -147044,7 +150324,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -147066,7 +150346,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -147113,7 +150393,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -147135,8 +150419,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -147152,7 +150436,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -147160,13 +150448,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -147349,8 +150641,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -147392,8 +150684,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -147413,8 +150705,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -147424,7 +150716,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -147548,13 +150844,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -147562,8 +150858,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -147653,8 +150949,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -147746,7 +151042,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -147996,13 +151296,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -148105,7 +151405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -148126,8 +151430,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -148136,8 +151440,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -148169,8 +151473,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -148221,8 +151525,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -148239,7 +151543,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -148267,7 +151575,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -148300,7 +151608,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -148322,7 +151630,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -148369,7 +151677,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -148391,8 +151703,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -148408,7 +151720,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -148416,13 +151732,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -148605,8 +151925,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -148648,8 +151968,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -148669,8 +151989,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -148680,7 +152000,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -148804,13 +152128,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -148818,8 +152142,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -148909,8 +152233,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -149002,7 +152326,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -149252,13 +152580,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -149361,7 +152689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -149382,8 +152714,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -149392,8 +152724,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -149425,8 +152757,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -149477,8 +152809,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -149495,7 +152827,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -149523,7 +152859,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -149556,7 +152892,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -149578,7 +152914,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -149625,7 +152961,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -149647,8 +152987,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -149664,7 +153004,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -149672,13 +153016,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -149861,8 +153209,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -149904,8 +153252,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -149925,8 +153273,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -149936,7 +153284,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -150060,13 +153412,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -150074,8 +153426,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -150165,8 +153517,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -150258,7 +153610,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -150508,13 +153864,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -150617,7 +153973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -150638,8 +153998,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -150648,8 +154008,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -150681,8 +154041,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -150733,8 +154093,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -150751,7 +154111,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -150779,7 +154143,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -150812,7 +154176,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -150834,7 +154198,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -150881,7 +154245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -150903,8 +154271,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -150920,7 +154288,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -150928,13 +154300,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -151117,8 +154493,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -151160,8 +154536,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -151181,8 +154557,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -151192,7 +154568,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -151316,13 +154696,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -151330,8 +154710,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -151421,8 +154801,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -151514,7 +154894,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -151764,13 +155148,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -151873,7 +155257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -151894,8 +155282,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -151904,8 +155292,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -151937,8 +155325,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -151989,8 +155377,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -152007,7 +155395,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -152035,7 +155427,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -152068,7 +155460,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -152090,7 +155482,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -152137,7 +155529,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -152159,8 +155555,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -152176,7 +155572,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -152184,13 +155584,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -152373,8 +155777,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -152416,8 +155820,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -152437,8 +155841,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -152448,7 +155852,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -152572,13 +155980,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -152586,8 +155994,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -152677,8 +156085,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -152770,7 +156178,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -153020,13 +156432,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -153129,7 +156541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -153150,8 +156566,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -153160,8 +156576,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -153193,8 +156609,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -153245,8 +156661,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -153263,7 +156679,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -153291,7 +156711,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -153324,7 +156744,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -153346,7 +156766,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -153393,7 +156813,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -153415,8 +156839,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -153432,7 +156856,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -153440,13 +156868,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -153629,8 +157061,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -153672,8 +157104,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -153693,8 +157125,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -153704,7 +157136,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -153828,13 +157264,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -153842,8 +157278,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -153933,8 +157369,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -154026,7 +157462,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -154276,13 +157716,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -154385,7 +157825,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -154406,8 +157850,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -154416,8 +157860,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -154449,8 +157893,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -154501,8 +157945,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -154519,7 +157963,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -154547,7 +157995,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -154580,7 +158028,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -154602,7 +158050,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -154649,7 +158097,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -154671,8 +158123,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -154688,7 +158140,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -154696,13 +158152,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -154885,8 +158345,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -154928,8 +158388,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -154949,8 +158409,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -154960,7 +158420,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -155084,13 +158548,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -155098,8 +158562,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -155189,8 +158653,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -155282,7 +158746,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -155532,13 +159000,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -155641,7 +159109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -155662,8 +159134,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -155672,8 +159144,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -155705,8 +159177,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -155757,8 +159229,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -155775,7 +159247,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -155803,7 +159279,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -155836,7 +159312,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -155858,7 +159334,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -155905,7 +159381,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -155927,8 +159407,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -155944,7 +159424,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -155952,13 +159436,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -156141,8 +159629,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -156184,8 +159672,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -156205,8 +159693,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -156216,7 +159704,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -156340,13 +159832,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -156354,8 +159846,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -156445,8 +159937,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -156538,7 +160030,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -156788,13 +160284,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -156897,7 +160393,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -156918,8 +160418,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -156928,8 +160428,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -156961,8 +160461,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -157013,8 +160513,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -157031,7 +160531,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -157059,7 +160563,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -157092,7 +160596,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -157114,7 +160618,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -157161,7 +160665,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -157183,8 +160691,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -157200,7 +160708,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -157208,13 +160720,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -157397,8 +160913,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -157440,8 +160956,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -157461,8 +160977,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -157472,7 +160988,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -157596,13 +161116,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -157610,8 +161130,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -157701,8 +161221,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -157794,7 +161314,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -158044,13 +161568,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -158153,7 +161677,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -158174,8 +161702,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -158184,8 +161712,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -158217,8 +161745,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -158269,8 +161797,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -158287,7 +161815,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -158315,7 +161847,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -158348,7 +161880,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -158370,7 +161902,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -158417,7 +161949,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -158439,8 +161975,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -158456,7 +161992,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -158464,13 +162004,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -158653,8 +162197,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -158696,8 +162240,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -158717,8 +162261,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -158728,7 +162272,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -158852,13 +162400,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -158866,8 +162414,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -158957,8 +162505,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -159050,7 +162598,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -159300,13 +162852,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -159409,7 +162961,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -159430,8 +162986,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -159440,8 +162996,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -159473,8 +163029,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -159525,8 +163081,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -159543,7 +163099,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -159571,7 +163131,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -159604,7 +163164,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -159626,7 +163186,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -159673,7 +163233,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -159695,8 +163259,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -159712,7 +163276,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -159720,13 +163288,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -159909,8 +163481,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -159952,8 +163524,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -159973,8 +163545,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -159984,7 +163556,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -160108,13 +163684,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -160122,8 +163698,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -160213,8 +163789,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -160306,7 +163882,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -160556,13 +164136,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -160665,7 +164245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -160686,8 +164270,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -160696,8 +164280,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -160729,8 +164313,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -160781,8 +164365,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -160799,7 +164383,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -160827,7 +164415,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -160860,7 +164448,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -160882,7 +164470,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -160929,7 +164517,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -160951,8 +164543,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -160968,7 +164560,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -160976,13 +164572,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -161165,8 +164765,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -161208,8 +164808,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -161229,8 +164829,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -161240,7 +164840,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -161364,13 +164968,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -161378,8 +164982,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -161469,8 +165073,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -161562,7 +165166,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -161812,13 +165420,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -161921,7 +165529,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -161942,8 +165554,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -161952,8 +165564,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -161985,8 +165597,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -162037,8 +165649,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -162055,7 +165667,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -162083,7 +165699,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -162116,7 +165732,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -162138,7 +165754,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -162185,7 +165801,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -162207,8 +165827,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -162224,7 +165844,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -162232,13 +165856,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -162421,8 +166049,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -162464,8 +166092,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -162485,8 +166113,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -162496,7 +166124,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -162620,13 +166252,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -162634,8 +166266,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -162725,8 +166357,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -162818,7 +166450,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -163068,13 +166704,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -163177,7 +166813,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -163198,8 +166838,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -163208,8 +166848,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -163241,8 +166881,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -163293,8 +166933,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -163311,7 +166951,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -163339,7 +166983,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -163372,7 +167016,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -163394,7 +167038,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -163441,7 +167085,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -163463,8 +167111,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -163480,7 +167128,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -163488,13 +167140,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -163677,8 +167333,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -163720,8 +167376,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -163741,8 +167397,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -163752,7 +167408,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -163876,13 +167536,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -163890,8 +167550,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -163981,8 +167641,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -164074,7 +167734,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -164324,13 +167988,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -164433,7 +168097,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -164454,8 +168122,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -164464,8 +168132,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -164497,8 +168165,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -164549,8 +168217,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -164567,7 +168235,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -164595,7 +168267,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -164628,7 +168300,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -164650,7 +168322,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -164697,7 +168369,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -164719,8 +168395,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -164736,7 +168412,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -164744,13 +168424,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -164933,8 +168617,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -164976,8 +168660,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -164997,8 +168681,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -165008,7 +168692,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -165132,13 +168820,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -165146,8 +168834,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -165237,8 +168925,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -165330,7 +169018,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -165580,13 +169272,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -165689,7 +169381,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -165710,8 +169406,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -165720,8 +169416,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -165753,8 +169449,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -165805,8 +169501,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -165823,7 +169519,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -165851,7 +169551,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -165884,7 +169584,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -165906,7 +169606,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -165953,7 +169653,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -165975,8 +169679,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -165992,7 +169696,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -166000,13 +169708,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -166189,8 +169901,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -166232,8 +169944,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -166253,8 +169965,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -166264,7 +169976,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -166388,13 +170104,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -166402,8 +170118,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -166493,8 +170209,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -166586,7 +170302,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -166836,13 +170556,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -166945,7 +170665,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -166966,8 +170690,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -166976,8 +170700,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -167009,8 +170733,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -167061,8 +170785,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -167079,7 +170803,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -167107,7 +170835,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -167140,7 +170868,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -167162,7 +170890,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -167209,7 +170937,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -167231,8 +170963,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -167248,7 +170980,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -167256,13 +170992,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -167445,8 +171185,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -167488,8 +171228,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -167509,8 +171249,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -167520,7 +171260,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -167644,13 +171388,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -167658,8 +171402,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -167749,8 +171493,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -167842,7 +171586,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -168092,13 +171840,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -168201,7 +171949,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -168222,8 +171974,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -168232,8 +171984,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -168265,8 +172017,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -168317,8 +172069,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -168335,7 +172087,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -168363,7 +172119,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -168396,7 +172152,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -168418,7 +172174,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -168465,7 +172221,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -168487,8 +172247,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -168504,7 +172264,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -168512,13 +172276,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -168701,8 +172469,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -168744,8 +172512,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -168765,8 +172533,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -168776,7 +172544,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -168900,13 +172672,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -168914,8 +172686,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -169005,8 +172777,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -169098,7 +172870,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -169348,13 +173124,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -169457,7 +173233,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -169478,8 +173258,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -169488,8 +173268,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -169521,8 +173301,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -169573,8 +173353,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -169591,7 +173371,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -169619,7 +173403,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -169652,7 +173436,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -169674,7 +173458,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -169721,7 +173505,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -169743,8 +173531,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -169760,7 +173548,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -169768,13 +173560,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -169957,8 +173753,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -170000,8 +173796,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -170021,8 +173817,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -170032,7 +173828,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -170156,13 +173956,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -170170,8 +173970,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -170261,8 +174061,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -170354,7 +174154,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -170604,13 +174408,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -170713,7 +174517,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -170734,8 +174542,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -170744,8 +174552,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -170777,8 +174585,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -170829,8 +174637,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -170847,7 +174655,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -170875,7 +174687,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -170908,7 +174720,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -170930,7 +174742,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -170977,7 +174789,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -170999,8 +174815,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -171016,7 +174832,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -171024,13 +174844,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -171213,8 +175037,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -171256,8 +175080,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -171277,8 +175101,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -171288,7 +175112,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -171412,13 +175240,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -171426,8 +175254,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -171517,8 +175345,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -171610,7 +175438,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -171860,13 +175692,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -171969,7 +175801,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -171990,8 +175826,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -172000,8 +175836,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -172033,8 +175869,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -172085,8 +175921,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -172103,7 +175939,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -172131,7 +175971,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -172164,7 +176004,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -172186,7 +176026,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -172233,7 +176073,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -172255,8 +176099,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -172272,7 +176116,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -172280,13 +176128,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -172469,8 +176321,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -172512,8 +176364,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -172533,8 +176385,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -172544,7 +176396,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -172668,13 +176524,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -172682,8 +176538,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -172773,8 +176629,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -172866,7 +176722,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -173116,13 +176976,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -173225,7 +177085,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -173246,8 +177110,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -173256,8 +177120,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -173289,8 +177153,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -173341,8 +177205,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -173359,7 +177223,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -173387,7 +177255,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -173420,7 +177288,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -173442,7 +177310,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -173489,7 +177357,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -173511,8 +177383,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -173528,7 +177400,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -173536,13 +177412,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -173725,8 +177605,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -173768,8 +177648,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -173789,8 +177669,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -173800,7 +177680,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -173924,13 +177808,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -173938,8 +177822,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -174029,8 +177913,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -174122,7 +178006,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -174372,13 +178260,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -174481,7 +178369,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -174502,8 +178394,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -174512,8 +178404,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -174545,8 +178437,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -174597,8 +178489,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -174615,7 +178507,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -174643,7 +178539,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -174676,7 +178572,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -174698,7 +178594,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -174745,7 +178641,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -174767,8 +178667,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -174784,7 +178684,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -174792,13 +178696,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -174981,8 +178889,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -175024,8 +178932,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -175045,8 +178953,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -175056,7 +178964,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -175180,13 +179092,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -175194,8 +179106,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -175285,8 +179197,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -175378,7 +179290,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -175628,13 +179544,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -175737,7 +179653,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -175758,8 +179678,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -175768,8 +179688,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -175801,8 +179721,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -175853,8 +179773,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -175871,7 +179791,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -175899,7 +179823,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -175932,7 +179856,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -175954,7 +179878,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -176001,7 +179925,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -176023,8 +179951,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -176040,7 +179968,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -176048,13 +179980,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -176237,8 +180173,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -176280,8 +180216,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -176301,8 +180237,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -176312,7 +180248,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -176436,13 +180376,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -176450,8 +180390,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -176541,8 +180481,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -176634,7 +180574,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -176884,13 +180828,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -176993,7 +180937,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -177014,8 +180962,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -177024,8 +180972,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -177057,8 +181005,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -177109,8 +181057,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -177127,7 +181075,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -177155,7 +181107,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -177188,7 +181140,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -177210,7 +181162,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -177257,7 +181209,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -177279,8 +181235,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -177296,7 +181252,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -177304,13 +181264,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -177493,8 +181457,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -177536,8 +181500,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -177557,8 +181521,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -177568,7 +181532,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -177692,13 +181660,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -177706,8 +181674,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -177797,8 +181765,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -177890,7 +181858,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -178140,13 +182112,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -178249,7 +182221,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -178270,8 +182246,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -178280,8 +182256,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -178313,8 +182289,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -178365,8 +182341,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -178383,7 +182359,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -178411,7 +182391,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -178444,7 +182424,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -178466,7 +182446,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -178513,7 +182493,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -178535,8 +182519,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -178552,7 +182536,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -178560,13 +182548,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -178749,8 +182741,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -178792,8 +182784,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -178813,8 +182805,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -178824,7 +182816,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -178948,13 +182944,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -178962,8 +182958,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -179053,8 +183049,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -179146,7 +183142,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -179396,13 +183396,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -179505,7 +183505,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -179526,8 +183530,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -179536,8 +183540,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -179569,8 +183573,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -179621,8 +183625,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -179639,7 +183643,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -179667,7 +183675,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -179700,7 +183708,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -179722,7 +183730,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -179769,7 +183777,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -179791,8 +183803,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -179808,7 +183820,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -179816,13 +183832,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -180005,8 +184025,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -180048,8 +184068,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -180069,8 +184089,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -180080,7 +184100,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -180204,13 +184228,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -180218,8 +184242,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -180309,8 +184333,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -180402,7 +184426,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -180652,13 +184680,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -180761,7 +184789,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -180782,8 +184814,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -180792,8 +184824,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -180825,8 +184857,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -180877,8 +184909,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -180895,7 +184927,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -180923,7 +184959,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -180956,7 +184992,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -180978,7 +185014,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -181025,7 +185061,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -181047,8 +185087,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -181064,7 +185104,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -181072,13 +185116,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -181261,8 +185309,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -181304,8 +185352,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -181325,8 +185373,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -181336,7 +185384,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -181460,13 +185512,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -181474,8 +185526,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -181565,8 +185617,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -181658,7 +185710,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -181908,13 +185964,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -182017,7 +186073,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -182038,8 +186098,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -182048,8 +186108,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -182081,8 +186141,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -182133,8 +186193,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -182151,7 +186211,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -182179,7 +186243,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -182212,7 +186276,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -182234,7 +186298,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -182281,7 +186345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -182303,8 +186371,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -182320,7 +186388,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -182328,13 +186400,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -182517,8 +186593,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -182560,8 +186636,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -182581,8 +186657,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -182592,7 +186668,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -182716,13 +186796,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -182730,8 +186810,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -182821,8 +186901,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -182914,7 +186994,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -183164,13 +187248,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -183273,7 +187357,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -183294,8 +187382,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -183304,8 +187392,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -183337,8 +187425,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -183389,8 +187477,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -183407,7 +187495,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -183435,7 +187527,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -183468,7 +187560,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -183490,7 +187582,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -183537,7 +187629,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -183559,8 +187655,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -183576,7 +187672,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -183584,13 +187684,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -183773,8 +187877,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -183816,8 +187920,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -183837,8 +187941,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -183848,7 +187952,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -183972,13 +188080,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -183986,8 +188094,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -184077,8 +188185,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -184170,7 +188278,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -184420,13 +188532,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -184529,7 +188641,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -184550,8 +188666,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -184560,8 +188676,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -184593,8 +188709,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -184645,8 +188761,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -184663,7 +188779,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -184691,7 +188811,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -184724,7 +188844,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -184746,7 +188866,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -184793,7 +188913,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -184815,8 +188939,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -184832,7 +188956,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -184840,13 +188968,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -185029,8 +189161,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -185072,8 +189204,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -185093,8 +189225,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -185104,7 +189236,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -185228,13 +189364,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -185242,8 +189378,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -185333,8 +189469,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -185426,7 +189562,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -185676,13 +189816,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -185785,7 +189925,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -185806,8 +189950,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -185816,8 +189960,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -185849,8 +189993,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -185901,8 +190045,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -185919,7 +190063,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -185947,7 +190095,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -185980,7 +190128,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -186002,7 +190150,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -186049,7 +190197,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -186071,8 +190223,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -186088,7 +190240,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -186096,13 +190252,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -186285,8 +190445,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -186328,8 +190488,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -186349,8 +190509,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -186360,7 +190520,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -186484,13 +190648,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -186498,8 +190662,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -186589,8 +190753,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -186682,7 +190846,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -186932,13 +191100,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -187041,7 +191209,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -187062,8 +191234,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -187072,8 +191244,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -187105,8 +191277,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -187157,8 +191329,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -187175,7 +191347,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -187203,7 +191379,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -187236,7 +191412,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -187258,7 +191434,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -187305,7 +191481,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -187327,8 +191507,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -187344,7 +191524,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -187352,13 +191536,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -187541,8 +191729,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -187584,8 +191772,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -187605,8 +191793,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -187616,7 +191804,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -187740,13 +191932,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -187754,8 +191946,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -187845,8 +192037,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -187938,7 +192130,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -188188,13 +192384,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -188297,7 +192493,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -188318,8 +192518,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -188328,8 +192528,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -188361,8 +192561,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -188413,8 +192613,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -188431,7 +192631,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -188459,7 +192663,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -188492,7 +192696,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -188514,7 +192718,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -188561,7 +192765,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -188583,8 +192791,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -188600,7 +192808,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -188608,13 +192820,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -188797,8 +193013,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -188840,8 +193056,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -188861,8 +193077,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -188872,7 +193088,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -188996,13 +193216,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -189010,8 +193230,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -189101,8 +193321,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -189194,7 +193414,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -189444,13 +193668,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -189553,7 +193777,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -189574,8 +193802,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -189584,8 +193812,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -189617,8 +193845,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -189669,8 +193897,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -189687,7 +193915,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -189715,7 +193947,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -189748,7 +193980,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -189770,7 +194002,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -189817,7 +194049,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -189839,8 +194075,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -189856,7 +194092,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -189864,13 +194104,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -190053,8 +194297,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -190096,8 +194340,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -190117,8 +194361,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -190128,7 +194372,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -190252,13 +194500,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -190266,8 +194514,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -190357,8 +194605,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -190450,7 +194698,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -190700,13 +194952,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -190809,7 +195061,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -190830,8 +195086,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -190840,8 +195096,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -190873,8 +195129,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -190925,8 +195181,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -190943,7 +195199,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -190971,7 +195231,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -191004,7 +195264,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -191026,7 +195286,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -191073,7 +195333,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -191095,8 +195359,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -191112,7 +195376,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -191120,13 +195388,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -191309,8 +195581,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -191352,8 +195624,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -191373,8 +195645,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -191384,7 +195656,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -191508,13 +195784,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -191522,8 +195798,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -191613,8 +195889,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -191706,7 +195982,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -191956,13 +196236,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -192065,7 +196345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -192086,8 +196370,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -192096,8 +196380,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -192129,8 +196413,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -192181,8 +196465,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -192199,7 +196483,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -192227,7 +196515,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -192260,7 +196548,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -192282,7 +196570,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -192329,7 +196617,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -192351,8 +196643,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -192368,7 +196660,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -192376,13 +196672,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -192565,8 +196865,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -192608,8 +196908,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -192629,8 +196929,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -192640,7 +196940,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -192764,13 +197068,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -192778,8 +197082,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -192869,8 +197173,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -192962,7 +197266,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -193212,13 +197520,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -193321,7 +197629,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -193342,8 +197654,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -193352,8 +197664,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -193385,8 +197697,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -193437,8 +197749,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -193455,7 +197767,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -193483,7 +197799,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -193516,7 +197832,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -193538,7 +197854,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -193585,7 +197901,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -193607,8 +197927,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -193624,7 +197944,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -193632,13 +197956,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -193821,8 +198149,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -193864,8 +198192,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -193885,8 +198213,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -193896,7 +198224,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -194020,13 +198352,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -194034,8 +198366,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -194125,8 +198457,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -194218,7 +198550,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -194468,13 +198804,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -194577,7 +198913,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -194598,8 +198938,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -194608,8 +198948,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -194641,8 +198981,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -194693,8 +199033,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -194711,7 +199051,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -194739,7 +199083,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -194772,7 +199116,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -194794,7 +199138,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -194841,7 +199185,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -194863,8 +199211,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -194880,7 +199228,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -194888,13 +199240,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -195077,8 +199433,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -195120,8 +199476,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -195141,8 +199497,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -195152,7 +199508,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -195276,13 +199636,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -195290,8 +199650,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -195381,8 +199741,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -195474,7 +199834,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -195724,13 +200088,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -195833,7 +200197,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -195854,8 +200222,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -195864,8 +200232,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -195897,8 +200265,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -195949,8 +200317,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -195967,7 +200335,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -195995,7 +200367,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -196028,7 +200400,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -196050,7 +200422,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -196097,7 +200469,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -196119,8 +200495,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -196136,7 +200512,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -196144,13 +200524,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -196333,8 +200717,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -196376,8 +200760,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -196397,8 +200781,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -196408,7 +200792,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -196532,13 +200920,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -196546,8 +200934,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -196637,8 +201025,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -196730,7 +201118,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -196980,13 +201372,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -197089,7 +201481,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -197110,8 +201506,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -197120,8 +201516,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -197153,8 +201549,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -197205,8 +201601,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -197223,7 +201619,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -197251,7 +201651,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -197284,7 +201684,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -197306,7 +201706,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -197353,7 +201753,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -197375,8 +201779,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -197392,7 +201796,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -197400,13 +201808,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -197589,8 +202001,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -197632,8 +202044,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -197653,8 +202065,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -197664,7 +202076,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -197788,13 +202204,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -197802,8 +202218,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -197893,8 +202309,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -197986,7 +202402,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -198236,13 +202656,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -198345,7 +202765,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -198366,8 +202790,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -198376,8 +202800,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -198409,8 +202833,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -198461,8 +202885,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -198479,7 +202903,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -198507,7 +202935,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -198540,7 +202968,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -198562,7 +202990,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -198609,7 +203037,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -198631,8 +203063,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -198648,7 +203080,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -198656,13 +203092,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -198845,8 +203285,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -198888,8 +203328,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -198909,8 +203349,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -198920,7 +203360,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -199044,13 +203488,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -199058,8 +203502,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -199149,8 +203593,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -199242,7 +203686,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -199492,13 +203940,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -199601,7 +204049,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -199622,8 +204074,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -199632,8 +204084,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -199665,8 +204117,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -199717,8 +204169,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -199735,7 +204187,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -199763,7 +204219,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -199796,7 +204252,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -199818,7 +204274,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -199865,7 +204321,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -199887,8 +204347,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -199904,7 +204364,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -199912,13 +204376,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -200101,8 +204569,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -200144,8 +204612,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -200165,8 +204633,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -200176,7 +204644,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -200300,13 +204772,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -200314,8 +204786,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -200405,8 +204877,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -200498,7 +204970,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -200748,13 +205224,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -200857,7 +205333,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -200878,8 +205358,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -200888,8 +205368,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -200921,8 +205401,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -200973,8 +205453,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -200991,7 +205471,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -201019,7 +205503,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -201052,7 +205536,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -201074,7 +205558,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -201121,7 +205605,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -201143,8 +205631,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -201160,7 +205648,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -201168,13 +205660,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -201357,8 +205853,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -201400,8 +205896,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -201421,8 +205917,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -201432,7 +205928,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -201556,13 +206056,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -201570,8 +206070,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -201661,8 +206161,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -201754,7 +206254,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -202004,13 +206508,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -202113,7 +206617,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -202134,8 +206642,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -202144,8 +206652,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -202177,8 +206685,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -202229,8 +206737,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -202247,7 +206755,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -202275,7 +206787,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -202308,7 +206820,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -202330,7 +206842,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -202377,7 +206889,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -202399,8 +206915,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -202416,7 +206932,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -202424,13 +206944,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -202613,8 +207137,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -202656,8 +207180,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -202677,8 +207201,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -202688,7 +207212,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -202812,13 +207340,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -202826,8 +207354,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -202917,8 +207445,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -203010,7 +207538,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -203260,13 +207792,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -203369,7 +207901,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -203390,8 +207926,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -203400,8 +207936,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -203433,8 +207969,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -203485,8 +208021,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -203503,7 +208039,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -203531,7 +208071,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -203564,7 +208104,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -203586,7 +208126,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -203633,7 +208173,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -203655,8 +208199,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -203672,7 +208216,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -203680,13 +208228,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -203869,8 +208421,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -203912,8 +208464,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -203933,8 +208485,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -203944,7 +208496,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -204068,13 +208624,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -204082,8 +208638,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -204173,8 +208729,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -204266,7 +208822,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -204516,13 +209076,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -204625,7 +209185,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -204646,8 +209210,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -204656,8 +209220,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -204689,8 +209253,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -204741,8 +209305,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -204759,7 +209323,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -204787,7 +209355,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -204820,7 +209388,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -204842,7 +209410,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -204889,7 +209457,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -204911,8 +209483,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -204928,7 +209500,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -204936,13 +209512,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -205125,8 +209705,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -205168,8 +209748,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -205189,8 +209769,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -205200,7 +209780,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -205324,13 +209908,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -205338,8 +209922,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -205429,8 +210013,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -205522,7 +210106,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -205772,13 +210360,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -205881,7 +210469,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -205902,8 +210494,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -205912,8 +210504,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -205945,8 +210537,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -205997,8 +210589,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -206015,7 +210607,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -206043,7 +210639,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -206076,7 +210672,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -206098,7 +210694,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -206145,7 +210741,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -206167,8 +210767,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -206184,7 +210784,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -206192,13 +210796,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -206381,8 +210989,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -206424,8 +211032,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -206445,8 +211053,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -206456,7 +211064,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -206580,13 +211192,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -206594,8 +211206,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -206685,8 +211297,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -206778,7 +211390,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -207028,13 +211644,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -207137,7 +211753,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -207158,8 +211778,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -207168,8 +211788,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -207201,8 +211821,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -207253,8 +211873,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -207271,7 +211891,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -207299,7 +211923,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -207332,7 +211956,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -207354,7 +211978,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -207401,7 +212025,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -207423,8 +212051,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -207440,7 +212068,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -207448,13 +212080,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -207637,8 +212273,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -207680,8 +212316,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -207701,8 +212337,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -207712,7 +212348,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -207836,13 +212476,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -207850,8 +212490,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -207941,8 +212581,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -208034,7 +212674,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -208284,13 +212928,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -208393,7 +213037,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -208414,8 +213062,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -208424,8 +213072,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -208457,8 +213105,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -208509,8 +213157,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -208527,7 +213175,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -208555,7 +213207,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -208588,7 +213240,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -208610,7 +213262,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -208657,7 +213309,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -208679,8 +213335,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -208696,7 +213352,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -208704,13 +213364,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -208893,8 +213557,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -208936,8 +213600,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -208957,8 +213621,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -208968,7 +213632,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -209092,13 +213760,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -209106,8 +213774,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -209197,8 +213865,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -209290,7 +213958,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -209540,13 +214212,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -209649,7 +214321,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -209670,8 +214346,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -209680,8 +214356,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -209713,8 +214389,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -209765,8 +214441,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -209783,7 +214459,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -209811,7 +214491,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -209844,7 +214524,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -209866,7 +214546,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -209913,7 +214593,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -209935,8 +214619,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -209952,7 +214636,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -209960,13 +214648,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -210149,8 +214841,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -210192,8 +214884,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -210213,8 +214905,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -210224,7 +214916,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -210348,13 +215044,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -210362,8 +215058,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -210453,8 +215149,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -210546,7 +215242,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -210796,13 +215496,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -210905,7 +215605,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -210926,8 +215630,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -210936,8 +215640,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -210969,8 +215673,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -211021,8 +215725,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -211039,7 +215743,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -211067,7 +215775,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -211100,7 +215808,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -211122,7 +215830,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -211169,7 +215877,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -211191,8 +215903,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -211208,7 +215920,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -211216,13 +215932,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -211405,8 +216125,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -211448,8 +216168,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -211469,8 +216189,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -211480,7 +216200,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -211604,13 +216328,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -211618,8 +216342,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -211709,8 +216433,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -211802,7 +216526,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -212052,13 +216780,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -212161,7 +216889,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -212182,8 +216914,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -212192,8 +216924,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -212225,8 +216957,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -212277,8 +217009,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -212295,7 +217027,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -212323,7 +217059,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -212356,7 +217092,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -212378,7 +217114,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -212425,7 +217161,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -212447,8 +217187,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -212464,7 +217204,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -212472,13 +217216,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -212661,8 +217409,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -212704,8 +217452,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -212725,8 +217473,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -212736,7 +217484,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -212860,13 +217612,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -212874,8 +217626,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -212965,8 +217717,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -213058,7 +217810,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -213308,13 +218064,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -213417,7 +218173,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -213438,8 +218198,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -213448,8 +218208,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -213481,8 +218241,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -213533,8 +218293,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -213551,7 +218311,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -213579,7 +218343,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -213612,7 +218376,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -213634,7 +218398,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -213681,7 +218445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -213703,8 +218471,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -213720,7 +218488,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -213728,13 +218500,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -213917,8 +218693,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -213960,8 +218736,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -213981,8 +218757,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -213992,7 +218768,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -214116,13 +218896,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -214130,8 +218910,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -214221,8 +219001,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -214314,7 +219094,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -214564,13 +219348,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -214673,7 +219457,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -214694,8 +219482,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -214704,8 +219492,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -214737,8 +219525,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -214789,8 +219577,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -214807,7 +219595,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -214835,7 +219627,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -214868,7 +219660,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -214890,7 +219682,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -214937,7 +219729,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -214959,8 +219755,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -214976,7 +219772,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -214984,13 +219784,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -215173,8 +219977,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -215216,8 +220020,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -215237,8 +220041,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -215248,7 +220052,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -215372,13 +220180,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -215386,8 +220194,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -215477,8 +220285,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -215570,7 +220378,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -215820,13 +220632,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -215929,7 +220741,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -215950,8 +220766,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -215960,8 +220776,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -215993,8 +220809,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -216045,8 +220861,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -216063,7 +220879,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -216091,7 +220911,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -216124,7 +220944,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -216146,7 +220966,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -216193,7 +221013,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -216215,8 +221039,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -216232,7 +221056,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -216240,13 +221068,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -216429,8 +221261,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -216472,8 +221304,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -216493,8 +221325,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -216504,7 +221336,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -216628,13 +221464,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -216642,8 +221478,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -216733,8 +221569,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -216826,7 +221662,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -217076,13 +221916,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -217185,7 +222025,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -217206,8 +222050,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -217216,8 +222060,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -217249,8 +222093,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -217301,8 +222145,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -217319,7 +222163,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -217347,7 +222195,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -217380,7 +222228,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -217402,7 +222250,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -217449,7 +222297,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -217471,8 +222323,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -217488,7 +222340,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -217496,13 +222352,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -217685,8 +222545,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -217728,8 +222588,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -217749,8 +222609,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -217760,7 +222620,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -217884,13 +222748,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -217898,8 +222762,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -217989,8 +222853,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -218082,7 +222946,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -218332,13 +223200,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -218441,7 +223309,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -218462,8 +223334,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -218472,8 +223344,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -218505,8 +223377,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -218557,8 +223429,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -218575,7 +223447,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -218603,7 +223479,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -218636,7 +223512,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -218658,7 +223534,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -218705,7 +223581,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -218727,8 +223607,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -218744,7 +223624,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -218752,13 +223636,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -218941,8 +223829,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -218984,8 +223872,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -219005,8 +223893,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -219016,7 +223904,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -219140,13 +224032,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -219154,8 +224046,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -219245,8 +224137,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -219338,7 +224230,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -219588,13 +224484,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -219697,7 +224593,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -219718,8 +224618,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -219728,8 +224628,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -219761,8 +224661,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -219813,8 +224713,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -219831,7 +224731,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -219859,7 +224763,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -219892,7 +224796,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -219914,7 +224818,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -219961,7 +224865,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -219983,8 +224891,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -220000,7 +224908,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -220008,13 +224920,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -220197,8 +225113,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -220240,8 +225156,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -220261,8 +225177,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -220272,7 +225188,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -220396,13 +225316,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -220410,8 +225330,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -220501,8 +225421,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -220594,7 +225514,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -220844,13 +225768,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -220953,7 +225877,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -220974,8 +225902,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -220984,8 +225912,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -221017,8 +225945,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -221069,8 +225997,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -221087,7 +226015,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -221115,7 +226047,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -221148,7 +226080,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -221170,7 +226102,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -221217,7 +226149,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -221239,8 +226175,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -221256,7 +226192,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -221264,13 +226204,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -221453,8 +226397,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -221496,8 +226440,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -221517,8 +226461,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -221528,7 +226472,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -221652,13 +226600,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -221666,8 +226614,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -221757,8 +226705,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -221850,7 +226798,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -222100,13 +227052,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -222209,7 +227161,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -222230,8 +227186,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -222240,8 +227196,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -222273,8 +227229,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -222325,8 +227281,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -222343,7 +227299,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -222371,7 +227331,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -222404,7 +227364,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -222426,7 +227386,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -222473,7 +227433,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -222495,8 +227459,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -222512,7 +227476,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -222520,13 +227488,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -222709,8 +227681,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -222752,8 +227724,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -222773,8 +227745,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -222784,7 +227756,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -222908,13 +227884,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -222922,8 +227898,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -223013,8 +227989,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -223106,7 +228082,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -223356,13 +228336,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -223465,7 +228445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -223486,8 +228470,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -223496,8 +228480,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -223529,8 +228513,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -223581,8 +228565,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -223599,7 +228583,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -223627,7 +228615,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -223660,7 +228648,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -223682,7 +228670,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -223729,7 +228717,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -223751,8 +228743,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -223768,7 +228760,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -223776,13 +228772,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -223965,8 +228965,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -224008,8 +229008,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -224029,8 +229029,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -224040,7 +229040,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -224164,13 +229168,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -224178,8 +229182,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -224269,8 +229273,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -224362,7 +229366,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -224612,13 +229620,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -224721,7 +229729,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -224742,8 +229754,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -224752,8 +229764,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -224785,8 +229797,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -224837,8 +229849,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -224855,7 +229867,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -224883,7 +229899,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -224916,7 +229932,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -224938,7 +229954,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -224985,7 +230001,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -225007,8 +230027,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -225024,7 +230044,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -225032,13 +230056,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -225221,8 +230249,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -225264,8 +230292,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -225285,8 +230313,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -225296,7 +230324,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -225420,13 +230452,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -225434,8 +230466,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -225525,8 +230557,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -225618,7 +230650,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -225868,13 +230904,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -225977,7 +231013,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -225998,8 +231038,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -226008,8 +231048,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -226041,8 +231081,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -226093,8 +231133,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -226111,7 +231151,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -226139,7 +231183,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -226172,7 +231216,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -226194,7 +231238,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -226241,7 +231285,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -226263,8 +231311,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -226280,7 +231328,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -226288,13 +231340,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -226477,8 +231533,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -226520,8 +231576,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -226541,8 +231597,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -226552,7 +231608,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -226676,13 +231736,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -226690,8 +231750,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -226781,8 +231841,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -226874,7 +231934,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -227124,13 +232188,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -227233,7 +232297,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -227254,8 +232322,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -227264,8 +232332,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -227297,8 +232365,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -227349,8 +232417,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -227367,7 +232435,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -227395,7 +232467,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -227428,7 +232500,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -227450,7 +232522,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -227497,7 +232569,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -227519,8 +232595,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -227536,7 +232612,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -227544,13 +232624,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -227733,8 +232817,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -227776,8 +232860,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -227797,8 +232881,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -227808,7 +232892,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -227932,13 +233020,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -227946,8 +233034,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -228037,8 +233125,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -228130,7 +233218,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -228380,13 +233472,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -228489,7 +233581,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -228510,8 +233606,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -228520,8 +233616,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -228553,8 +233649,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -228605,8 +233701,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -228623,7 +233719,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -228651,7 +233751,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -228684,7 +233784,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -228706,7 +233806,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -228753,7 +233853,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -228775,8 +233879,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -228792,7 +233896,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -228800,13 +233908,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -228989,8 +234101,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -229032,8 +234144,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -229053,8 +234165,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -229064,7 +234176,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -229188,13 +234304,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -229202,8 +234318,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -229293,8 +234409,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -229386,7 +234502,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -229636,13 +234756,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -229745,7 +234865,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -229766,8 +234890,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -229776,8 +234900,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -229809,8 +234933,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -229861,8 +234985,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -229879,7 +235003,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -229907,7 +235035,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -229940,7 +235068,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -229962,7 +235090,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -230009,7 +235137,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -230031,8 +235163,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -230048,7 +235180,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -230056,13 +235192,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -230245,8 +235385,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -230288,8 +235428,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -230309,8 +235449,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -230320,7 +235460,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -230444,13 +235588,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -230458,8 +235602,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -230549,8 +235693,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -230642,7 +235786,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -230892,13 +236040,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -231001,7 +236149,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -231022,8 +236174,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -231032,8 +236184,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -231065,8 +236217,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -231117,8 +236269,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -231135,7 +236287,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -231163,7 +236319,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -231196,7 +236352,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -231218,7 +236374,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -231265,7 +236421,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -231287,8 +236447,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -231304,7 +236464,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -231312,13 +236476,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -231501,8 +236669,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -231544,8 +236712,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -231565,8 +236733,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -231576,7 +236744,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -231700,13 +236872,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -231714,8 +236886,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -231805,8 +236977,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -231898,7 +237070,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -232148,13 +237324,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -232257,7 +237433,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -232278,8 +237458,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -232288,8 +237468,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -232321,8 +237501,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -232373,8 +237553,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -232391,7 +237571,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -232419,7 +237603,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -232452,7 +237636,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -232474,7 +237658,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -232521,7 +237705,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -232543,8 +237731,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -232560,7 +237748,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -232568,13 +237760,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -232757,8 +237953,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -232800,8 +237996,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -232821,8 +238017,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -232832,7 +238028,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -232956,13 +238156,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -232970,8 +238170,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -233061,8 +238261,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -233154,7 +238354,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -233404,13 +238608,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -233513,7 +238717,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -233534,8 +238742,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -233544,8 +238752,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -233577,8 +238785,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -233629,8 +238837,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -233647,7 +238855,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -233675,7 +238887,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -233708,7 +238920,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -233730,7 +238942,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -233777,7 +238989,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -233799,8 +239015,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -233816,7 +239032,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -233824,13 +239044,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -234013,8 +239237,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -234056,8 +239280,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -234077,8 +239301,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -234088,7 +239312,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -234212,13 +239440,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -234226,8 +239454,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -234317,8 +239545,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -234410,7 +239638,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -234660,13 +239892,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -234769,7 +240001,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -234790,8 +240026,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -234800,8 +240036,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -234833,8 +240069,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -234885,8 +240121,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -234903,7 +240139,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -234931,7 +240171,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -234964,7 +240204,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -234986,7 +240226,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -235033,7 +240273,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -235055,8 +240299,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -235072,7 +240316,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -235080,13 +240328,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -235269,8 +240521,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -235312,8 +240564,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -235333,8 +240585,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -235344,7 +240596,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -235468,13 +240724,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -235482,8 +240738,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -235573,8 +240829,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -235666,7 +240922,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -235916,13 +241176,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -236025,7 +241285,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -236046,8 +241310,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -236056,8 +241320,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -236089,8 +241353,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -236141,8 +241405,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -236159,7 +241423,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -236187,7 +241455,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -236220,7 +241488,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -236242,7 +241510,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -236289,7 +241557,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -236311,8 +241583,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -236328,7 +241600,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -236336,13 +241612,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -236525,8 +241805,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -236568,8 +241848,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -236589,8 +241869,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -236600,7 +241880,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -236724,13 +242008,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -236738,8 +242022,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -236829,8 +242113,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -236922,7 +242206,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -237172,13 +242460,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -237281,7 +242569,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -237302,8 +242594,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -237312,8 +242604,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -237345,8 +242637,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -237397,8 +242689,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -237415,7 +242707,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -237443,7 +242739,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -237476,7 +242772,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -237498,7 +242794,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -237545,7 +242841,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -237567,8 +242867,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -237584,7 +242884,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -237592,13 +242896,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -237781,8 +243089,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -237824,8 +243132,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -237845,8 +243153,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -237856,7 +243164,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -237980,13 +243292,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -237994,8 +243306,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -238085,8 +243397,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -238178,7 +243490,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -238428,13 +243744,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -238537,7 +243853,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -238558,8 +243878,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -238568,8 +243888,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -238601,8 +243921,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -238653,8 +243973,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -238671,7 +243991,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -238699,7 +244023,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -238732,7 +244056,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -238754,7 +244078,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -238801,7 +244125,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -238823,8 +244151,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -238840,7 +244168,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -238848,13 +244180,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -239037,8 +244373,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -239080,8 +244416,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -239101,8 +244437,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -239112,7 +244448,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -239236,13 +244576,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -239250,8 +244590,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -239341,8 +244681,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -239434,7 +244774,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -239684,13 +245028,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -239793,7 +245137,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -239814,8 +245162,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -239824,8 +245172,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -239857,8 +245205,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -239909,8 +245257,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -239927,7 +245275,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -239955,7 +245307,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -239988,7 +245340,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -240010,7 +245362,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -240057,7 +245409,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -240079,8 +245435,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -240096,7 +245452,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -240104,13 +245464,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -240293,8 +245657,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -240336,8 +245700,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -240357,8 +245721,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -240368,7 +245732,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -240492,13 +245860,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -240506,8 +245874,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -240597,8 +245965,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -240690,7 +246058,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -240940,13 +246312,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -241049,7 +246421,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -241070,8 +246446,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -241080,8 +246456,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -241113,8 +246489,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -241165,8 +246541,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -241183,7 +246559,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -241211,7 +246591,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -241244,7 +246624,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -241266,7 +246646,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -241313,7 +246693,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -241335,8 +246719,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -241352,7 +246736,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -241360,13 +246748,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -241549,8 +246941,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -241592,8 +246984,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -241613,8 +247005,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -241624,7 +247016,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -241748,13 +247144,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -241762,8 +247158,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -241853,8 +247249,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -241946,7 +247342,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -242196,13 +247596,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -242305,7 +247705,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -242326,8 +247730,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -242336,8 +247740,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -242369,8 +247773,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -242421,8 +247825,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -242439,7 +247843,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -242467,7 +247875,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -242500,7 +247908,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -242522,7 +247930,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -242569,7 +247977,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -242591,8 +248003,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -242608,7 +248020,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -242616,13 +248032,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -242805,8 +248225,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -242848,8 +248268,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -242869,8 +248289,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -242880,7 +248300,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -243004,13 +248428,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -243018,8 +248442,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -243109,8 +248533,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -243202,7 +248626,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -243452,13 +248880,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -243561,7 +248989,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -243582,8 +249014,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -243592,8 +249024,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -243625,8 +249057,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -243677,8 +249109,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -243695,7 +249127,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -243723,7 +249159,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -243756,7 +249192,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -243778,7 +249214,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -243825,7 +249261,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -243847,8 +249287,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -243864,7 +249304,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -243872,13 +249316,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -244061,8 +249509,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -244104,8 +249552,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -244125,8 +249573,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -244136,7 +249584,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -244260,13 +249712,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -244274,8 +249726,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -244365,8 +249817,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -244458,7 +249910,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -244708,13 +250164,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -244817,7 +250273,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -244838,8 +250298,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -244848,8 +250308,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -244881,8 +250341,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -244933,8 +250393,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -244951,7 +250411,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -244979,7 +250443,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -245012,7 +250476,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -245034,7 +250498,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -245081,7 +250545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -245103,8 +250571,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -245120,7 +250588,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -245128,13 +250600,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -245317,8 +250793,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -245360,8 +250836,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -245381,8 +250857,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -245392,7 +250868,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -245516,13 +250996,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -245530,8 +251010,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -245621,8 +251101,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -245714,7 +251194,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -245964,13 +251448,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -246073,7 +251557,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -246094,8 +251582,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -246104,8 +251592,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -246137,8 +251625,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -246189,8 +251677,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -246207,7 +251695,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -246235,7 +251727,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -246268,7 +251760,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -246290,7 +251782,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -246337,7 +251829,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -246359,8 +251855,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -246376,7 +251872,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -246384,13 +251884,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -246573,8 +252077,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -246616,8 +252120,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -246637,8 +252141,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -246648,7 +252152,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -246772,13 +252280,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -246786,8 +252294,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -246877,8 +252385,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -246970,7 +252478,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -247220,13 +252732,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -247329,7 +252841,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -247350,8 +252866,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -247360,8 +252876,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -247393,8 +252909,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -247445,8 +252961,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -247463,7 +252979,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -247491,7 +253011,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -247524,7 +253044,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -247546,7 +253066,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -247593,7 +253113,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -247615,8 +253139,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -247632,7 +253156,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -247640,13 +253168,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -247829,8 +253361,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -247872,8 +253404,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -247893,8 +253425,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -247904,7 +253436,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -248028,13 +253564,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -248042,8 +253578,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -248133,8 +253669,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -248226,7 +253762,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -248476,13 +254016,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -248585,7 +254125,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -248606,8 +254150,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -248616,8 +254160,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -248649,8 +254193,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -248701,8 +254245,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -248719,7 +254263,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -248747,7 +254295,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -248780,7 +254328,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -248802,7 +254350,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -248849,7 +254397,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -248871,8 +254423,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -248888,7 +254440,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -248896,13 +254452,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -249085,8 +254645,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -249128,8 +254688,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -249149,8 +254709,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -249160,7 +254720,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -249284,13 +254848,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -249298,8 +254862,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -249389,8 +254953,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -249482,7 +255046,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -249732,13 +255300,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -249841,7 +255409,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -249862,8 +255434,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -249872,8 +255444,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -249905,8 +255477,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -249957,8 +255529,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -249975,7 +255547,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -250003,7 +255579,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -250036,7 +255612,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -250058,7 +255634,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -250105,7 +255681,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -250127,8 +255707,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -250144,7 +255724,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -250152,13 +255736,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -250341,8 +255929,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -250384,8 +255972,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -250405,8 +255993,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -250416,7 +256004,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -250540,13 +256132,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -250554,8 +256146,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -250645,8 +256237,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -250738,7 +256330,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -250988,13 +256584,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -251097,7 +256693,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -251118,8 +256718,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -251128,8 +256728,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -251161,8 +256761,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -251213,8 +256813,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -251231,7 +256831,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -251259,7 +256863,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -251292,7 +256896,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -251314,7 +256918,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -251361,7 +256965,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -251383,8 +256991,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -251400,7 +257008,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -251408,13 +257020,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -251597,8 +257213,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -251640,8 +257256,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -251661,8 +257277,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -251672,7 +257288,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -251796,13 +257416,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -251810,8 +257430,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -251901,8 +257521,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -251994,7 +257614,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -252244,13 +257868,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -252353,7 +257977,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -252374,8 +258002,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -252384,8 +258012,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -252417,8 +258045,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -252469,8 +258097,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -252487,7 +258115,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -252515,7 +258147,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -252548,7 +258180,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -252570,7 +258202,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -252617,7 +258249,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -252639,8 +258275,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -252656,7 +258292,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -252664,13 +258304,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -252853,8 +258497,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -252896,8 +258540,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -252917,8 +258561,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -252928,7 +258572,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -253052,13 +258700,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -253066,8 +258714,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -253157,8 +258805,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -253250,7 +258898,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -253500,13 +259152,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -253609,7 +259261,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -253630,8 +259286,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -253640,8 +259296,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -253673,8 +259329,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -253725,8 +259381,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -253743,7 +259399,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -253771,7 +259431,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -253804,7 +259464,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -253826,7 +259486,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -253873,7 +259533,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -253895,8 +259559,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -253912,7 +259576,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -253920,13 +259588,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -254109,8 +259781,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -254152,8 +259824,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -254173,8 +259845,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -254184,7 +259856,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -254308,13 +259984,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -254322,8 +259998,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -254413,8 +260089,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -254506,7 +260182,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -254756,13 +260436,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -254865,7 +260545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -254886,8 +260570,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -254896,8 +260580,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -254929,8 +260613,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -254981,8 +260665,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -254999,7 +260683,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -255027,7 +260715,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -255060,7 +260748,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -255082,7 +260770,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -255129,7 +260817,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -255151,8 +260843,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -255168,7 +260860,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -255176,13 +260872,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -255365,8 +261065,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -255408,8 +261108,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -255429,8 +261129,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -255440,7 +261140,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -255564,13 +261268,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -255578,8 +261282,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -255669,8 +261373,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -255762,7 +261466,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -256012,13 +261720,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -256121,7 +261829,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -256142,8 +261854,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -256152,8 +261864,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -256185,8 +261897,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -256237,8 +261949,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -256255,7 +261967,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -256283,7 +261999,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -256316,7 +262032,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -256338,7 +262054,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -256385,7 +262101,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -256407,8 +262127,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -256424,7 +262144,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -256432,13 +262156,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -256621,8 +262349,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -256664,8 +262392,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -256685,8 +262413,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -256696,7 +262424,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -256820,13 +262552,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -256834,8 +262566,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -256925,8 +262657,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -257018,7 +262750,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -257268,13 +263004,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -257377,7 +263113,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -257398,8 +263138,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -257408,8 +263148,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -257441,8 +263181,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -257493,8 +263233,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -257511,7 +263251,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -257539,7 +263283,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -257572,7 +263316,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -257594,7 +263338,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -257641,7 +263385,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -257663,8 +263411,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -257680,7 +263428,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -257688,13 +263440,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -257877,8 +263633,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -257920,8 +263676,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -257941,8 +263697,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -257952,7 +263708,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -258076,13 +263836,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -258090,8 +263850,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -258181,8 +263941,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -258274,7 +264034,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -258524,13 +264288,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -258633,7 +264397,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -258654,8 +264422,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -258664,8 +264432,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -258697,8 +264465,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -258749,8 +264517,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -258767,7 +264535,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -258795,7 +264567,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -258828,7 +264600,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -258850,7 +264622,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -258897,7 +264669,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -258919,8 +264695,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -258936,7 +264712,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -258944,13 +264724,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -259133,8 +264917,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -259176,8 +264960,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -259197,8 +264981,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -259208,7 +264992,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -259332,13 +265120,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -259346,8 +265134,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -259437,8 +265225,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -259530,7 +265318,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -259780,13 +265572,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -259889,7 +265681,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -259910,8 +265706,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -259920,8 +265716,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -259953,8 +265749,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -260005,8 +265801,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -260023,7 +265819,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -260051,7 +265851,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -260084,7 +265884,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -260106,7 +265906,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -260153,7 +265953,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -260175,8 +265979,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -260192,7 +265996,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -260200,13 +266008,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -260389,8 +266201,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -260432,8 +266244,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -260453,8 +266265,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -260464,7 +266276,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -260588,13 +266404,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -260602,8 +266418,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -260693,8 +266509,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -260786,7 +266602,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -261036,13 +266856,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -261145,7 +266965,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -261166,8 +266990,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -261176,8 +267000,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -261209,8 +267033,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -261261,8 +267085,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -261279,7 +267103,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -261307,7 +267135,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -261340,7 +267168,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -261362,7 +267190,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -261409,7 +267237,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -261431,8 +267263,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -261448,7 +267280,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -261456,13 +267292,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -261645,8 +267485,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -261688,8 +267528,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -261709,8 +267549,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -261720,7 +267560,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -261844,13 +267688,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -261858,8 +267702,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -261949,8 +267793,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -262042,7 +267886,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -262292,13 +268140,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -262401,7 +268249,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -262422,8 +268274,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -262432,8 +268284,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -262465,8 +268317,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -262517,8 +268369,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -262535,7 +268387,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -262563,7 +268419,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -262596,7 +268452,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -262618,7 +268474,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -262665,7 +268521,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -262687,8 +268547,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -262704,7 +268564,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -262712,13 +268576,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -262901,8 +268769,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -262944,8 +268812,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -262965,8 +268833,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -262976,7 +268844,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -263100,13 +268972,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -263114,8 +268986,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -263205,8 +269077,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -263298,7 +269170,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -263548,13 +269424,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -263657,7 +269533,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -263678,8 +269558,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -263688,8 +269568,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -263721,8 +269601,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -263773,8 +269653,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -263791,7 +269671,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -263819,7 +269703,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -263852,7 +269736,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -263874,7 +269758,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -263921,7 +269805,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -263943,8 +269831,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -263960,7 +269848,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -263968,13 +269860,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -264157,8 +270053,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -264200,8 +270096,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -264221,8 +270117,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -264232,7 +270128,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -264356,13 +270256,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -264370,8 +270270,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -264461,8 +270361,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -264554,7 +270454,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -264804,13 +270708,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -264913,7 +270817,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -264934,8 +270842,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -264944,8 +270852,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -264977,8 +270885,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -265029,8 +270937,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -265047,7 +270955,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -265075,7 +270987,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -265108,7 +271020,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -265130,7 +271042,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -265177,7 +271089,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -265199,8 +271115,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -265216,7 +271132,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -265224,13 +271144,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -265413,8 +271337,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -265456,8 +271380,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -265477,8 +271401,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -265488,7 +271412,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -265612,13 +271540,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -265626,8 +271554,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -265717,8 +271645,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -265810,7 +271738,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -266060,13 +271992,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -266169,7 +272101,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -266190,8 +272126,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -266200,8 +272136,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -266233,8 +272169,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -266285,8 +272221,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -266303,7 +272239,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -266331,7 +272271,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -266364,7 +272304,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -266386,7 +272326,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -266433,7 +272373,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -266455,8 +272399,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -266472,7 +272416,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -266480,13 +272428,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -266669,8 +272621,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -266712,8 +272664,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -266733,8 +272685,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -266744,7 +272696,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -266868,13 +272824,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -266882,8 +272838,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -266973,8 +272929,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -267066,7 +273022,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -267316,13 +273276,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -267425,7 +273385,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -267446,8 +273410,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -267456,8 +273420,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -267489,8 +273453,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -267541,8 +273505,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -267559,7 +273523,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -267587,7 +273555,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -267620,7 +273588,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -267642,7 +273610,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -267689,7 +273657,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -267711,8 +273683,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -267728,7 +273700,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -267736,13 +273712,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -267925,8 +273905,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -267968,8 +273948,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -267989,8 +273969,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -268000,7 +273980,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -268124,13 +274108,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -268138,8 +274122,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -268229,8 +274213,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -268322,7 +274306,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -268572,13 +274560,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -268681,7 +274669,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -268702,8 +274694,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -268712,8 +274704,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -268745,8 +274737,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -268797,8 +274789,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -268815,7 +274807,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -268843,7 +274839,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -268876,7 +274872,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -268898,7 +274894,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -268945,7 +274941,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -268967,8 +274967,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -268984,7 +274984,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -268992,13 +274996,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -269181,8 +275189,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -269224,8 +275232,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -269245,8 +275253,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -269256,7 +275264,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -269380,13 +275392,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -269394,8 +275406,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -269485,8 +275497,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -269578,7 +275590,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -269828,13 +275844,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -269937,7 +275953,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -269958,8 +275978,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -269968,8 +275988,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -270001,8 +276021,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -270053,8 +276073,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -270071,7 +276091,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -270099,7 +276123,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -270132,7 +276156,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -270154,7 +276178,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -270201,7 +276225,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -270223,8 +276251,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -270240,7 +276268,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -270248,13 +276280,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -270437,8 +276473,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -270480,8 +276516,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -270501,8 +276537,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -270512,7 +276548,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -270636,13 +276676,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -270650,8 +276690,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -270741,8 +276781,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -270834,7 +276874,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -271084,13 +277128,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -271193,7 +277237,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -271214,8 +277262,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -271224,8 +277272,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -271257,8 +277305,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -271309,8 +277357,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -271327,7 +277375,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -271355,7 +277407,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -271388,7 +277440,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -271410,7 +277462,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -271457,7 +277509,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -271479,8 +277535,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -271496,7 +277552,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -271504,13 +277564,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -271693,8 +277757,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -271736,8 +277800,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -271757,8 +277821,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -271768,7 +277832,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -271892,13 +277960,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -271906,8 +277974,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -271997,8 +278065,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -272090,7 +278158,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -272340,13 +278412,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -272449,7 +278521,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -272470,8 +278546,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -272480,8 +278556,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -272513,8 +278589,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -272565,8 +278641,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -272583,7 +278659,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -272611,7 +278691,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -272644,7 +278724,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -272666,7 +278746,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -272713,7 +278793,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -272735,8 +278819,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -272752,7 +278836,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -272760,13 +278848,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -272949,8 +279041,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -272992,8 +279084,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -273013,8 +279105,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -273024,7 +279116,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -273148,13 +279244,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -273162,8 +279258,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -273253,8 +279349,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -273346,7 +279442,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -273596,13 +279696,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -273705,7 +279805,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -273726,8 +279830,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -273736,8 +279840,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -273769,8 +279873,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -273821,8 +279925,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -273839,7 +279943,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -273867,7 +279975,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -273900,7 +280008,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -273922,7 +280030,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -273969,7 +280077,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -273991,8 +280103,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -274008,7 +280120,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -274016,13 +280132,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -274205,8 +280325,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -274248,8 +280368,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -274269,8 +280389,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -274280,7 +280400,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -274404,13 +280528,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -274418,8 +280542,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -274509,8 +280633,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -274602,7 +280726,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -274852,13 +280980,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -274961,7 +281089,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -274982,8 +281114,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -274992,8 +281124,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -275025,8 +281157,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -275077,8 +281209,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -275095,7 +281227,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -275123,7 +281259,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -275156,7 +281292,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -275178,7 +281314,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -275225,7 +281361,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -275247,8 +281387,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -275264,7 +281404,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -275272,13 +281416,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -275461,8 +281609,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -275504,8 +281652,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -275525,8 +281673,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -275536,7 +281684,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -275660,13 +281812,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -275674,8 +281826,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -275765,8 +281917,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -275858,7 +282010,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -276108,13 +282264,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -276217,7 +282373,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -276238,8 +282398,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -276248,8 +282408,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -276281,8 +282441,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -276333,8 +282493,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -276351,7 +282511,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -276379,7 +282543,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -276412,7 +282576,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -276434,7 +282598,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -276481,7 +282645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -276503,8 +282671,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -276520,7 +282688,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -276528,13 +282700,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -276717,8 +282893,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -276760,8 +282936,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -276781,8 +282957,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -276792,7 +282968,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -276916,13 +283096,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -276930,8 +283110,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -277021,8 +283201,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -277114,7 +283294,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -277364,13 +283548,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -277473,7 +283657,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -277494,8 +283682,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -277504,8 +283692,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -277537,8 +283725,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -277589,8 +283777,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -277607,7 +283795,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -277635,7 +283827,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -277668,7 +283860,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -277690,7 +283882,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -277737,7 +283929,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -277759,8 +283955,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -277776,7 +283972,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -277784,13 +283984,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -277973,8 +284177,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -278016,8 +284220,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -278037,8 +284241,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -278048,7 +284252,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -278172,13 +284380,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -278186,8 +284394,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -278277,8 +284485,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -278370,7 +284578,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -278620,13 +284832,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -278729,7 +284941,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -278750,8 +284966,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -278760,8 +284976,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -278793,8 +285009,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -278845,8 +285061,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -278863,7 +285079,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -278891,7 +285111,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -278924,7 +285144,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -278946,7 +285166,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -278993,7 +285213,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -279015,8 +285239,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -279032,7 +285256,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -279040,13 +285268,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -279229,8 +285461,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -279272,8 +285504,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -279293,8 +285525,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -279304,7 +285536,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -279428,13 +285664,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -279442,8 +285678,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -279533,8 +285769,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -279626,7 +285862,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -279876,13 +286116,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -279985,7 +286225,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -280006,8 +286250,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -280016,8 +286260,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -280049,8 +286293,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -280101,8 +286345,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -280119,7 +286363,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -280147,7 +286395,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -280180,7 +286428,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -280202,7 +286450,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -280249,7 +286497,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -280271,8 +286523,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -280288,7 +286540,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -280296,13 +286552,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -280485,8 +286745,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -280528,8 +286788,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -280549,8 +286809,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -280560,7 +286820,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -280684,13 +286948,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -280698,8 +286962,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -280789,8 +287053,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -280882,7 +287146,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -281132,13 +287400,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -281241,7 +287509,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -281262,8 +287534,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -281272,8 +287544,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -281305,8 +287577,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -281357,8 +287629,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -281375,7 +287647,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -281403,7 +287679,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -281436,7 +287712,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -281458,7 +287734,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -281505,7 +287781,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -281527,8 +287807,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -281544,7 +287824,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -281552,13 +287836,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -281741,8 +288029,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -281784,8 +288072,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -281805,8 +288093,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -281816,7 +288104,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -281940,13 +288232,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -281954,8 +288246,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -282045,8 +288337,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -282138,7 +288430,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -282388,13 +288684,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -282497,7 +288793,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -282518,8 +288818,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -282528,8 +288828,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -282561,8 +288861,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -282613,8 +288913,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -282631,7 +288931,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -282659,7 +288963,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -282692,7 +288996,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -282714,7 +289018,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -282761,7 +289065,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -282783,8 +289091,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -282800,7 +289108,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -282808,13 +289120,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -282997,8 +289313,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -283040,8 +289356,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -283061,8 +289377,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -283072,7 +289388,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -283196,13 +289516,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -283210,8 +289530,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -283301,8 +289621,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -283394,7 +289714,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -283644,13 +289968,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -283753,7 +290077,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -283774,8 +290102,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -283784,8 +290112,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -283817,8 +290145,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -283869,8 +290197,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -283887,7 +290215,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -283915,7 +290247,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -283948,7 +290280,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -283970,7 +290302,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -284017,7 +290349,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -284039,8 +290375,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -284056,7 +290392,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -284064,13 +290404,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -284253,8 +290597,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -284296,8 +290640,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -284317,8 +290661,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -284328,7 +290672,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -284452,13 +290800,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -284466,8 +290814,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -284557,8 +290905,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -284650,7 +290998,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -284900,13 +291252,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -285009,7 +291361,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -285030,8 +291386,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -285040,8 +291396,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -285073,8 +291429,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -285125,8 +291481,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -285143,7 +291499,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -285171,7 +291531,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -285204,7 +291564,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -285226,7 +291586,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -285273,7 +291633,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -285295,8 +291659,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -285312,7 +291676,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -285320,13 +291688,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -285509,8 +291881,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -285552,8 +291924,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -285573,8 +291945,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -285584,7 +291956,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -285708,13 +292084,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -285722,8 +292098,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -285813,8 +292189,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -285906,7 +292282,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -286156,13 +292536,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -286265,7 +292645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -286286,8 +292670,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -286296,8 +292680,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -286329,8 +292713,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -286381,8 +292765,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -286399,7 +292783,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -286427,7 +292815,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -286460,7 +292848,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -286482,7 +292870,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -286529,7 +292917,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -286551,8 +292943,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -286568,7 +292960,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -286576,13 +292972,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -286765,8 +293165,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -286808,8 +293208,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -286829,8 +293229,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -286840,7 +293240,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -286964,13 +293368,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -286978,8 +293382,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -287069,8 +293473,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -287162,7 +293566,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -287412,13 +293820,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -287521,7 +293929,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -287542,8 +293954,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -287552,8 +293964,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -287585,8 +293997,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -287637,8 +294049,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -287655,7 +294067,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -287683,7 +294099,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -287716,7 +294132,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -287738,7 +294154,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -287785,7 +294201,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -287807,8 +294227,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -287824,7 +294244,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -287832,13 +294256,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -288021,8 +294449,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -288064,8 +294492,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -288085,8 +294513,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -288096,7 +294524,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -288220,13 +294652,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -288234,8 +294666,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -288325,8 +294757,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -288418,7 +294850,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -288668,13 +295104,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -288777,7 +295213,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -288798,8 +295238,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -288808,8 +295248,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -288841,8 +295281,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -288893,8 +295333,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -288911,7 +295351,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -288939,7 +295383,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -288972,7 +295416,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -288994,7 +295438,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -289041,7 +295485,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -289063,8 +295511,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -289080,7 +295528,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -289088,13 +295540,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -289277,8 +295733,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -289320,8 +295776,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -289341,8 +295797,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -289352,7 +295808,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -289476,13 +295936,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -289490,8 +295950,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -289581,8 +296041,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -289674,7 +296134,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -289924,13 +296388,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -290033,7 +296497,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -290054,8 +296522,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -290064,8 +296532,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -290097,8 +296565,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -290149,8 +296617,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -290167,7 +296635,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -290195,7 +296667,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -290228,7 +296700,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -290250,7 +296722,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -290297,7 +296769,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -290319,8 +296795,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -290336,7 +296812,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -290344,13 +296824,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -290533,8 +297017,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -290576,8 +297060,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -290597,8 +297081,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -290608,7 +297092,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -290732,13 +297220,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -290746,8 +297234,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -290837,8 +297325,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -290930,7 +297418,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -291180,13 +297672,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -291289,7 +297781,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -291310,8 +297806,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -291320,8 +297816,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -291353,8 +297849,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -291405,8 +297901,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -291423,7 +297919,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -291451,7 +297951,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -291484,7 +297984,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -291506,7 +298006,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -291553,7 +298053,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -291575,8 +298079,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -291592,7 +298096,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -291600,13 +298108,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -291789,8 +298301,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -291832,8 +298344,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -291853,8 +298365,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -291864,7 +298376,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -291988,13 +298504,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -292002,8 +298518,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -292093,8 +298609,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -292186,7 +298702,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -292436,13 +298956,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -292545,7 +299065,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -292566,8 +299090,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -292576,8 +299100,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -292609,8 +299133,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -292661,8 +299185,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -292679,7 +299203,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -292707,7 +299235,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -292740,7 +299268,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -292762,7 +299290,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -292809,7 +299337,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -292831,8 +299363,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -292848,7 +299380,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -292856,13 +299392,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -293045,8 +299585,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -293088,8 +299628,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -293109,8 +299649,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -293120,7 +299660,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -293244,13 +299788,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -293258,8 +299802,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -293349,8 +299893,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -293442,7 +299986,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -293692,13 +300240,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -293801,7 +300349,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -293822,8 +300374,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -293832,8 +300384,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -293865,8 +300417,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -293917,8 +300469,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -293935,7 +300487,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -293963,7 +300519,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -293996,7 +300552,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -294018,7 +300574,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -294065,7 +300621,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -294087,8 +300647,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -294104,7 +300664,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -294112,13 +300676,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -294301,8 +300869,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -294344,8 +300912,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -294365,8 +300933,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -294376,7 +300944,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -294500,13 +301072,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -294514,8 +301086,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -294605,8 +301177,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -294698,7 +301270,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -294948,13 +301524,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -295057,7 +301633,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -295078,8 +301658,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -295088,8 +301668,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -295121,8 +301701,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -295173,8 +301753,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -295191,7 +301771,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -295219,7 +301803,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -295252,7 +301836,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -295274,7 +301858,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -295321,7 +301905,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -295343,8 +301931,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -295360,7 +301948,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -295368,13 +301960,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -295557,8 +302153,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -295600,8 +302196,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -295621,8 +302217,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -295632,7 +302228,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -295756,13 +302356,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -295770,8 +302370,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -295861,8 +302461,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -295954,7 +302554,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -296204,13 +302808,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -296313,7 +302917,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -296334,8 +302942,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -296344,8 +302952,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -296377,8 +302985,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -296429,8 +303037,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -296447,7 +303055,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -296475,7 +303087,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -296508,7 +303120,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -296530,7 +303142,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -296577,7 +303189,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -296599,8 +303215,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -296616,7 +303232,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -296624,13 +303244,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -296813,8 +303437,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -296856,8 +303480,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -296877,8 +303501,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -296888,7 +303512,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -297012,13 +303640,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -297026,8 +303654,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -297117,8 +303745,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -297210,7 +303838,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -297460,13 +304092,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -297569,7 +304201,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -297590,8 +304226,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -297600,8 +304236,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -297633,8 +304269,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -297685,8 +304321,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -297703,7 +304339,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -297731,7 +304371,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -297764,7 +304404,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -297786,7 +304426,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -297833,7 +304473,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -297855,8 +304499,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -297872,7 +304516,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -297880,13 +304528,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -298069,8 +304721,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -298112,8 +304764,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -298133,8 +304785,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -298144,7 +304796,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -298268,13 +304924,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -298282,8 +304938,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -298373,8 +305029,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -298466,7 +305122,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -298716,13 +305376,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -298825,7 +305485,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -298846,8 +305510,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -298856,8 +305520,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -298889,8 +305553,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -298941,8 +305605,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -298959,7 +305623,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -298987,7 +305655,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -299020,7 +305688,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -299042,7 +305710,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -299089,7 +305757,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -299111,8 +305783,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -299128,7 +305800,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -299136,13 +305812,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -299325,8 +306005,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -299368,8 +306048,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -299389,8 +306069,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -299400,7 +306080,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -299524,13 +306208,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -299538,8 +306222,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -299629,8 +306313,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -299722,7 +306406,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -299972,13 +306660,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -300081,7 +306769,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -300102,8 +306794,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -300112,8 +306804,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -300145,8 +306837,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -300197,8 +306889,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -300215,7 +306907,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -300243,7 +306939,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -300276,7 +306972,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -300298,7 +306994,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -300345,7 +307041,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -300367,8 +307067,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -300384,7 +307084,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -300392,13 +307096,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -300581,8 +307289,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -300624,8 +307332,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -300645,8 +307353,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -300656,7 +307364,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -300780,13 +307492,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -300794,8 +307506,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -300885,8 +307597,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -300978,7 +307690,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -301228,13 +307944,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -301337,7 +308053,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -301358,8 +308078,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -301368,8 +308088,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -301401,8 +308121,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -301453,8 +308173,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -301471,7 +308191,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -301499,7 +308223,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -301532,7 +308256,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -301554,7 +308278,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -301601,7 +308325,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -301623,8 +308351,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -301640,7 +308368,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -301648,13 +308380,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -301837,8 +308573,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -301880,8 +308616,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -301901,8 +308637,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -301912,7 +308648,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -302036,13 +308776,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -302050,8 +308790,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -302141,8 +308881,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -302234,7 +308974,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -302484,13 +309228,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -302593,7 +309337,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -302614,8 +309362,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -302624,8 +309372,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -302657,8 +309405,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -302709,8 +309457,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -302727,7 +309475,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -302755,7 +309507,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -302788,7 +309540,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -302810,7 +309562,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -302857,7 +309609,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -302879,8 +309635,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -302896,7 +309652,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -302904,13 +309664,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -303093,8 +309857,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -303136,8 +309900,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -303157,8 +309921,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -303168,7 +309932,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -303292,13 +310060,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -303306,8 +310074,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -303397,8 +310165,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -303490,7 +310258,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -303740,13 +310512,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -303849,7 +310621,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -303870,8 +310646,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -303880,8 +310656,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -303913,8 +310689,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -303965,8 +310741,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -303983,7 +310759,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -304011,7 +310791,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -304044,7 +310824,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -304066,7 +310846,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -304113,7 +310893,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -304135,8 +310919,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -304152,7 +310936,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -304160,13 +310948,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -304349,8 +311141,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -304392,8 +311184,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -304413,8 +311205,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -304424,7 +311216,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -304548,13 +311344,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -304562,8 +311358,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -304653,8 +311449,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -304746,7 +311542,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -304996,13 +311796,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -305105,7 +311905,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -305126,8 +311930,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -305136,8 +311940,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -305169,8 +311973,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -305221,8 +312025,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -305239,7 +312043,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -305267,7 +312075,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -305300,7 +312108,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -305322,7 +312130,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -305369,7 +312177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -305391,8 +312203,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -305408,7 +312220,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -305416,13 +312232,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -305605,8 +312425,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -305648,8 +312468,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -305669,8 +312489,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -305680,7 +312500,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -305804,13 +312628,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -305818,8 +312642,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -305909,8 +312733,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -306002,7 +312826,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -306252,13 +313080,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -306361,7 +313189,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -306382,8 +313214,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -306392,8 +313224,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -306425,8 +313257,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -306477,8 +313309,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -306495,7 +313327,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -306523,7 +313359,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -306556,7 +313392,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -306578,7 +313414,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -306625,7 +313461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -306647,8 +313487,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -306664,7 +313504,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -306672,13 +313516,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -306861,8 +313709,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -306904,8 +313752,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -306925,8 +313773,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -306936,7 +313784,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -307060,13 +313912,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -307074,8 +313926,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -307165,8 +314017,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -307258,7 +314110,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -307508,13 +314364,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -307617,7 +314473,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -307638,8 +314498,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -307648,8 +314508,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -307681,8 +314541,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -307733,8 +314593,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -307751,7 +314611,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -307779,7 +314643,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -307812,7 +314676,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -307834,7 +314698,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -307881,7 +314745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -307903,8 +314771,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -307920,7 +314788,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -307928,13 +314800,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -308117,8 +314993,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -308160,8 +315036,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -308181,8 +315057,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -308192,7 +315068,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -308316,13 +315196,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -308330,8 +315210,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -308421,8 +315301,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -308514,7 +315394,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -308764,13 +315648,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -308873,7 +315757,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -308894,8 +315782,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -308904,8 +315792,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -308937,8 +315825,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -308989,8 +315877,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -309007,7 +315895,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -309035,7 +315927,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -309068,7 +315960,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -309090,7 +315982,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -309137,7 +316029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -309159,8 +316055,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -309176,7 +316072,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -309184,13 +316084,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -309373,8 +316277,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -309416,8 +316320,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -309437,8 +316341,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -309448,7 +316352,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -309572,13 +316480,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -309586,8 +316494,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -309677,8 +316585,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -309770,7 +316678,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -310020,13 +316932,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -310129,7 +317041,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -310150,8 +317066,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -310160,8 +317076,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -310193,8 +317109,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -310245,8 +317161,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -310263,7 +317179,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -310291,7 +317211,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -310324,7 +317244,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -310346,7 +317266,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -310393,7 +317313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -310415,8 +317339,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -310432,7 +317356,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -310440,13 +317368,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -310629,8 +317561,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -310672,8 +317604,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -310693,8 +317625,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -310704,7 +317636,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -310828,13 +317764,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -310842,8 +317778,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -310933,8 +317869,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -311026,7 +317962,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -311276,13 +318216,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -311385,7 +318325,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -311406,8 +318350,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -311416,8 +318360,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -311449,8 +318393,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -311501,8 +318445,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -311519,7 +318463,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -311547,7 +318495,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -311580,7 +318528,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -311602,7 +318550,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -311649,7 +318597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -311671,8 +318623,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -311688,7 +318640,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -311696,13 +318652,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -311885,8 +318845,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -311928,8 +318888,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -311949,8 +318909,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -311960,7 +318920,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -312084,13 +319048,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -312098,8 +319062,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -312189,8 +319153,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -312282,7 +319246,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -312532,13 +319500,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -312641,7 +319609,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -312662,8 +319634,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -312672,8 +319644,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -312705,8 +319677,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -312757,8 +319729,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -312775,7 +319747,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -312803,7 +319779,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -312836,7 +319812,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -312858,7 +319834,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -312905,7 +319881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -312927,8 +319907,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -312944,7 +319924,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -312952,13 +319936,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -313141,8 +320129,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -313184,8 +320172,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -313205,8 +320193,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -313216,7 +320204,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -313340,13 +320332,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -313354,8 +320346,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -313445,8 +320437,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -313538,7 +320530,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -313788,13 +320784,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -313897,7 +320893,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -313918,8 +320918,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -313928,8 +320928,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -313961,8 +320961,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -314013,8 +321013,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -314031,7 +321031,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -314059,7 +321063,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -314092,7 +321096,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -314114,7 +321118,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -314161,7 +321165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -314183,8 +321191,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -314200,7 +321208,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -314208,13 +321220,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -314397,8 +321413,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -314440,8 +321456,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -314461,8 +321477,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -314472,7 +321488,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -314596,13 +321616,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -314610,8 +321630,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -314701,8 +321721,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -314794,7 +321814,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -315044,13 +322068,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -315153,7 +322177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -315174,8 +322202,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -315184,8 +322212,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -315217,8 +322245,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -315269,8 +322297,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -315287,7 +322315,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -315315,7 +322347,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -315348,7 +322380,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -315370,7 +322402,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -315417,7 +322449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -315439,8 +322475,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -315456,7 +322492,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -315464,13 +322504,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -315653,8 +322697,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -315696,8 +322740,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -315717,8 +322761,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -315728,7 +322772,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -315852,13 +322900,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -315866,8 +322914,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -315957,8 +323005,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -316050,7 +323098,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -316300,13 +323352,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -316409,7 +323461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -316430,8 +323486,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -316440,8 +323496,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -316473,8 +323529,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -316525,8 +323581,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -316543,7 +323599,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -316571,7 +323631,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -316604,7 +323664,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -316626,7 +323686,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -316673,7 +323733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -316695,8 +323759,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -316712,7 +323776,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -316720,13 +323788,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -316909,8 +323981,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -316952,8 +324024,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -316973,8 +324045,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -316984,7 +324056,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -317108,13 +324184,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -317122,8 +324198,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -317213,8 +324289,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -317306,7 +324382,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -317556,13 +324636,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -317665,7 +324745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -317686,8 +324770,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -317696,8 +324780,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -317729,8 +324813,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -317781,8 +324865,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -317799,7 +324883,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -317827,7 +324915,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -317860,7 +324948,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -317882,7 +324970,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -317929,7 +325017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -317951,8 +325043,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -317968,7 +325060,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -317976,13 +325072,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -318165,8 +325265,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -318208,8 +325308,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -318229,8 +325329,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -318240,7 +325340,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -318364,13 +325468,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -318378,8 +325482,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -318469,8 +325573,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -318562,7 +325666,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -318812,13 +325920,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -318921,7 +326029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -318942,8 +326054,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -318952,8 +326064,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -318985,8 +326097,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -319037,8 +326149,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -319055,7 +326167,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -319083,7 +326199,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -319116,7 +326232,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -319138,7 +326254,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -319185,7 +326301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -319207,8 +326327,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -319224,7 +326344,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -319232,13 +326356,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -319421,8 +326549,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -319464,8 +326592,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -319485,8 +326613,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -319496,7 +326624,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -319620,13 +326752,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -319634,8 +326766,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -319725,8 +326857,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -319818,7 +326950,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -320068,13 +327204,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -320177,7 +327313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -320198,8 +327338,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -320208,8 +327348,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -320241,8 +327381,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -320293,8 +327433,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -320311,7 +327451,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -320339,7 +327483,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -320372,7 +327516,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -320394,7 +327538,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -320441,7 +327585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -320463,8 +327611,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -320480,7 +327628,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -320488,13 +327640,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -320677,8 +327833,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -320720,8 +327876,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -320741,8 +327897,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -320752,7 +327908,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -320876,13 +328036,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -320890,8 +328050,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -320981,8 +328141,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -321074,7 +328234,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -321324,13 +328488,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -321433,7 +328597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -321454,8 +328622,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -321464,8 +328632,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -321497,8 +328665,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -321549,8 +328717,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -321567,7 +328735,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -321595,7 +328767,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -321628,7 +328800,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -321650,7 +328822,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -321697,7 +328869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -321719,8 +328895,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -321736,7 +328912,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -321744,13 +328924,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -321933,8 +329117,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -321976,8 +329160,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -321997,8 +329181,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -322008,7 +329192,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -322132,13 +329320,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -322146,8 +329334,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -322237,8 +329425,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -322330,7 +329518,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -322580,13 +329772,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -322689,7 +329881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -322710,8 +329906,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -322720,8 +329916,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -322753,8 +329949,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -322805,8 +330001,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -322823,7 +330019,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -322851,7 +330051,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -322884,7 +330084,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -322906,7 +330106,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -322953,7 +330153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -322975,8 +330179,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -322992,7 +330196,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -323000,13 +330208,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -323189,8 +330401,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -323232,8 +330444,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -323253,8 +330465,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -323264,7 +330476,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -323388,13 +330604,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -323402,8 +330618,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -323493,8 +330709,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -323586,7 +330802,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -323836,13 +331056,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -323945,7 +331165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -323966,8 +331190,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -323976,8 +331200,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -324009,8 +331233,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -324061,8 +331285,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -324079,7 +331303,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -324107,7 +331335,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -324140,7 +331368,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -324162,7 +331390,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -324209,7 +331437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -324231,8 +331463,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -324248,7 +331480,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -324256,13 +331492,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -324445,8 +331685,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -324488,8 +331728,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -324509,8 +331749,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -324520,7 +331760,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -324644,13 +331888,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -324658,8 +331902,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -324749,8 +331993,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -324842,7 +332086,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -325092,13 +332340,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -325201,7 +332449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -325222,8 +332474,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -325232,8 +332484,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -325265,8 +332517,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -325317,8 +332569,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -325335,7 +332587,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -325363,7 +332619,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -325396,7 +332652,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -325418,7 +332674,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -325465,7 +332721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -325487,8 +332747,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -325504,7 +332764,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -325512,13 +332776,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -325701,8 +332969,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -325744,8 +333012,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -325765,8 +333033,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -325776,7 +333044,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -325900,13 +333172,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -325914,8 +333186,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -326005,8 +333277,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -326098,7 +333370,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -326348,13 +333624,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -326457,7 +333733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -326478,8 +333758,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -326488,8 +333768,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -326521,8 +333801,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -326573,8 +333853,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -326591,7 +333871,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -326619,7 +333903,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -326652,7 +333936,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -326674,7 +333958,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -326721,7 +334005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -326743,8 +334031,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -326760,7 +334048,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -326768,13 +334060,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -326957,8 +334253,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -327000,8 +334296,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -327021,8 +334317,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -327032,7 +334328,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -327156,13 +334456,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -327170,8 +334470,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -327261,8 +334561,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -327354,7 +334654,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -327604,13 +334908,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -327713,7 +335017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -327734,8 +335042,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -327744,8 +335052,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -327777,8 +335085,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -327829,8 +335137,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -327847,7 +335155,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -327875,7 +335187,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -327908,7 +335220,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -327930,7 +335242,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -327977,7 +335289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -327999,8 +335315,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -328016,7 +335332,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -328024,13 +335344,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -328213,8 +335537,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -328256,8 +335580,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -328277,8 +335601,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -328288,7 +335612,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -328412,13 +335740,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -328426,8 +335754,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -328517,8 +335845,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -328610,7 +335938,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -328860,13 +336192,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -328969,7 +336301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -328990,8 +336326,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -329000,8 +336336,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -329033,8 +336369,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -329085,8 +336421,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -329103,7 +336439,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -329131,7 +336471,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -329164,7 +336504,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -329186,7 +336526,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -329233,7 +336573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -329255,8 +336599,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -329272,7 +336616,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -329280,13 +336628,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -329469,8 +336821,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -329512,8 +336864,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -329533,8 +336885,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -329544,7 +336896,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -329668,13 +337024,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -329682,8 +337038,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -329773,8 +337129,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -329866,7 +337222,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -330116,13 +337476,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -330225,7 +337585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -330246,8 +337610,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -330256,8 +337620,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -330289,8 +337653,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -330341,8 +337705,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -330359,7 +337723,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -330387,7 +337755,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -330420,7 +337788,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -330442,7 +337810,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -330489,7 +337857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -330511,8 +337883,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -330528,7 +337900,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -330536,13 +337912,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -330725,8 +338105,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -330768,8 +338148,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -330789,8 +338169,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -330800,7 +338180,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -330924,13 +338308,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -330938,8 +338322,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -331029,8 +338413,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -331122,7 +338506,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -331372,13 +338760,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -331481,7 +338869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -331502,8 +338894,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -331512,8 +338904,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -331545,8 +338937,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -331597,8 +338989,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -331615,7 +339007,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -331643,7 +339039,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -331676,7 +339072,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -331698,7 +339094,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -331745,7 +339141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -331767,8 +339167,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -331784,7 +339184,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -331792,13 +339196,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -331981,8 +339389,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -332024,8 +339432,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -332045,8 +339453,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -332056,7 +339464,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -332180,13 +339592,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -332194,8 +339606,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -332285,8 +339697,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -332378,7 +339790,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -332628,13 +340044,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -332737,7 +340153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -332758,8 +340178,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -332768,8 +340188,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -332801,8 +340221,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -332853,8 +340273,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -332871,7 +340291,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -332899,7 +340323,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -332932,7 +340356,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -332954,7 +340378,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -333001,7 +340425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -333023,8 +340451,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -333040,7 +340468,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -333048,13 +340480,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -333237,8 +340673,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -333280,8 +340716,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -333301,8 +340737,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -333312,7 +340748,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -333436,13 +340876,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -333450,8 +340890,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -333541,8 +340981,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -333634,7 +341074,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -333884,13 +341328,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -333993,7 +341437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -334014,8 +341462,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -334024,8 +341472,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -334057,8 +341505,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -334109,8 +341557,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -334127,7 +341575,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -334155,7 +341607,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -334188,7 +341640,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -334210,7 +341662,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -334257,7 +341709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -334279,8 +341735,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -334296,7 +341752,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -334304,13 +341764,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -334493,8 +341957,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -334536,8 +342000,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -334557,8 +342021,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -334568,7 +342032,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -334692,13 +342160,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -334706,8 +342174,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -334797,8 +342265,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -334890,7 +342358,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -335140,13 +342612,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -335249,7 +342721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -335270,8 +342746,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -335280,8 +342756,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -335313,8 +342789,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -335365,8 +342841,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -335383,7 +342859,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -335411,7 +342891,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -335444,7 +342924,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -335466,7 +342946,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -335513,7 +342993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -335535,8 +343019,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -335552,7 +343036,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -335560,13 +343048,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -335749,8 +343241,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -335792,8 +343284,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -335813,8 +343305,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -335824,7 +343316,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -335948,13 +343444,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -335962,8 +343458,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -336053,8 +343549,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -336146,7 +343642,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -336396,13 +343896,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -336505,7 +344005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -336526,8 +344030,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -336536,8 +344040,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -336569,8 +344073,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -336621,8 +344125,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -336639,7 +344143,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -336667,7 +344175,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -336700,7 +344208,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -336722,7 +344230,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -336769,7 +344277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -336791,8 +344303,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -336808,7 +344320,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -336816,13 +344332,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -337005,8 +344525,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -337048,8 +344568,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -337069,8 +344589,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -337080,7 +344600,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -337204,13 +344728,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -337218,8 +344742,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -337309,8 +344833,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -337402,7 +344926,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -337652,13 +345180,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -337761,7 +345289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -337782,8 +345314,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -337792,8 +345324,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -337825,8 +345357,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -337877,8 +345409,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -337895,7 +345427,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -337923,7 +345459,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -337956,7 +345492,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -337978,7 +345514,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -338025,7 +345561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -338047,8 +345587,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -338064,7 +345604,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -338072,13 +345616,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -338261,8 +345809,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -338304,8 +345852,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -338325,8 +345873,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -338336,7 +345884,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -338460,13 +346012,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -338474,8 +346026,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -338565,8 +346117,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -338658,7 +346210,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -338908,13 +346464,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -339017,7 +346573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -339038,8 +346598,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -339048,8 +346608,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -339081,8 +346641,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -339133,8 +346693,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -339151,7 +346711,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -339179,7 +346743,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -339212,7 +346776,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -339234,7 +346798,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -339281,7 +346845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -339303,8 +346871,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -339320,7 +346888,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -339328,13 +346900,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -339517,8 +347093,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -339560,8 +347136,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -339581,8 +347157,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -339592,7 +347168,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -339716,13 +347296,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -339730,8 +347310,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -339821,8 +347401,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -339914,7 +347494,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -340164,13 +347748,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -340273,7 +347857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -340294,8 +347882,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -340304,8 +347892,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -340337,8 +347925,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -340389,8 +347977,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -340407,7 +347995,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -340435,7 +348027,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -340468,7 +348060,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -340490,7 +348082,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -340537,7 +348129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -340559,8 +348155,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -340576,7 +348172,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -340584,13 +348184,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -340773,8 +348377,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -340816,8 +348420,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -340837,8 +348441,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -340848,7 +348452,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -340972,13 +348580,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -340986,8 +348594,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -341077,8 +348685,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -341170,7 +348778,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -341420,13 +349032,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -341529,7 +349141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -341550,8 +349166,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -341560,8 +349176,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -341593,8 +349209,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -341645,8 +349261,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -341663,7 +349279,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -341691,7 +349311,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -341724,7 +349344,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -341746,7 +349366,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -341793,7 +349413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -341815,8 +349439,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -341832,7 +349456,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -341840,13 +349468,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -342029,8 +349661,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -342072,8 +349704,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -342093,8 +349725,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -342104,7 +349736,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -342228,13 +349864,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -342242,8 +349878,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -342333,8 +349969,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -342426,7 +350062,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -342676,13 +350316,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -342785,7 +350425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -342806,8 +350450,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -342816,8 +350460,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -342849,8 +350493,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -342901,8 +350545,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -342919,7 +350563,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -342947,7 +350595,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -342980,7 +350628,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -343002,7 +350650,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -343049,7 +350697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -343071,8 +350723,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -343088,7 +350740,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -343096,13 +350752,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -343285,8 +350945,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -343328,8 +350988,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -343349,8 +351009,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -343360,7 +351020,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -343484,13 +351148,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -343498,8 +351162,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -343589,8 +351253,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -343682,7 +351346,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -343932,13 +351600,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -344041,7 +351709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -344062,8 +351734,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -344072,8 +351744,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -344105,8 +351777,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -344157,8 +351829,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -344175,7 +351847,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -344203,7 +351879,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -344236,7 +351912,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -344258,7 +351934,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -344305,7 +351981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -344327,8 +352007,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -344344,7 +352024,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -344352,13 +352036,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -344541,8 +352229,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -344584,8 +352272,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -344605,8 +352293,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -344616,7 +352304,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -344740,13 +352432,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -344754,8 +352446,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -344845,8 +352537,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -344938,7 +352630,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -345188,13 +352884,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -345297,7 +352993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -345318,8 +353018,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -345328,8 +353028,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -345361,8 +353061,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -345413,8 +353113,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -345431,7 +353131,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -345459,7 +353163,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -345492,7 +353196,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -345514,7 +353218,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -345561,7 +353265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -345583,8 +353291,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -345600,7 +353308,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -345608,13 +353320,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -345797,8 +353513,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -345840,8 +353556,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -345861,8 +353577,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -345872,7 +353588,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -345996,13 +353716,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -346010,8 +353730,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -346101,8 +353821,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -346194,7 +353914,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -346444,13 +354168,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -346553,7 +354277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -346574,8 +354302,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -346584,8 +354312,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -346617,8 +354345,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -346669,8 +354397,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -346687,7 +354415,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -346715,7 +354447,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -346748,7 +354480,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -346770,7 +354502,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -346817,7 +354549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -346839,8 +354575,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -346856,7 +354592,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -346864,13 +354604,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -347053,8 +354797,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -347096,8 +354840,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -347117,8 +354861,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -347128,7 +354872,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -347252,13 +355000,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -347266,8 +355014,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -347357,8 +355105,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -347450,7 +355198,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -347700,13 +355452,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -347809,7 +355561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -347830,8 +355586,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -347840,8 +355596,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -347873,8 +355629,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -347925,8 +355681,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -347943,7 +355699,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -347971,7 +355731,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -348004,7 +355764,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -348026,7 +355786,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -348073,7 +355833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -348095,8 +355859,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -348112,7 +355876,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -348120,13 +355888,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -348309,8 +356081,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -348352,8 +356124,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -348373,8 +356145,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -348384,7 +356156,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -348508,13 +356284,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -348522,8 +356298,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -348613,8 +356389,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -348706,7 +356482,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -348956,13 +356736,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -349065,7 +356845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -349086,8 +356870,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -349096,8 +356880,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -349129,8 +356913,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -349181,8 +356965,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -349199,7 +356983,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -349227,7 +357015,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -349260,7 +357048,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -349282,7 +357070,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -349329,7 +357117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -349351,8 +357143,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -349368,7 +357160,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -349376,13 +357172,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -349565,8 +357365,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -349608,8 +357408,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -349629,8 +357429,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -349640,7 +357440,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -349764,13 +357568,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -349778,8 +357582,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -349869,8 +357673,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -349962,7 +357766,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -350212,13 +358020,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -350321,7 +358129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -350342,8 +358154,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -350352,8 +358164,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -350385,8 +358197,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -350437,8 +358249,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -350455,7 +358267,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -350483,7 +358299,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -350516,7 +358332,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -350538,7 +358354,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -350585,7 +358401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -350607,8 +358427,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -350624,7 +358444,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -350632,13 +358456,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -350821,8 +358649,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -350864,8 +358692,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -350885,8 +358713,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -350896,7 +358724,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -351020,13 +358852,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -351034,8 +358866,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -351125,8 +358957,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -351218,7 +359050,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -351468,13 +359304,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -351577,7 +359413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -351598,8 +359438,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -351608,8 +359448,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -351641,8 +359481,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -351693,8 +359533,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -351711,7 +359551,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -351739,7 +359583,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -351772,7 +359616,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -351794,7 +359638,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -351841,7 +359685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -351863,8 +359711,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -351880,7 +359728,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -351888,13 +359740,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -352077,8 +359933,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -352120,8 +359976,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -352141,8 +359997,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -352152,7 +360008,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -352276,13 +360136,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -352290,8 +360150,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -352381,8 +360241,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -352474,7 +360334,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -352724,13 +360588,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -352833,7 +360697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -352854,8 +360722,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -352864,8 +360732,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -352897,8 +360765,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -352949,8 +360817,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -352967,7 +360835,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -352995,7 +360867,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -353028,7 +360900,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -353050,7 +360922,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -353097,7 +360969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -353119,8 +360995,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -353136,7 +361012,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -353144,13 +361024,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -353333,8 +361217,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -353376,8 +361260,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -353397,8 +361281,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -353408,7 +361292,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -353532,13 +361420,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -353546,8 +361434,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -353637,8 +361525,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -353730,7 +361618,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -353980,13 +361872,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -354089,7 +361981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -354110,8 +362006,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -354120,8 +362016,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -354153,8 +362049,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -354205,8 +362101,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -354223,7 +362119,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -354251,7 +362151,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -354284,7 +362184,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -354306,7 +362206,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -354353,7 +362253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -354375,8 +362279,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -354392,7 +362296,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -354400,13 +362308,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -354589,8 +362501,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -354632,8 +362544,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -354653,8 +362565,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -354664,7 +362576,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -354788,13 +362704,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -354802,8 +362718,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -354893,8 +362809,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -354986,7 +362902,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -355236,13 +363156,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -355345,7 +363265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -355366,8 +363290,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -355376,8 +363300,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -355409,8 +363333,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -355461,8 +363385,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -355479,7 +363403,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -355507,7 +363435,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -355540,7 +363468,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -355562,7 +363490,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -355609,7 +363537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -355631,8 +363563,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -355648,7 +363580,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -355656,13 +363592,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -355845,8 +363785,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -355888,8 +363828,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -355909,8 +363849,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -355920,7 +363860,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -356044,13 +363988,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -356058,8 +364002,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -356149,8 +364093,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -356242,7 +364186,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -356492,13 +364440,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -356601,7 +364549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -356622,8 +364574,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -356632,8 +364584,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -356665,8 +364617,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -356717,8 +364669,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -356735,7 +364687,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -356763,7 +364719,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -356796,7 +364752,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -356818,7 +364774,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -356865,7 +364821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -356887,8 +364847,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -356904,7 +364864,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -356912,13 +364876,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -357101,8 +365069,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -357144,8 +365112,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -357165,8 +365133,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -357176,7 +365144,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -357300,13 +365272,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -357314,8 +365286,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -357405,8 +365377,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -357498,7 +365470,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -357748,13 +365724,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -357857,7 +365833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -357878,8 +365858,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -357888,8 +365868,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -357921,8 +365901,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -357973,8 +365953,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -357991,7 +365971,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -358019,7 +366003,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -358052,7 +366036,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -358074,7 +366058,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -358121,7 +366105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -358143,8 +366131,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -358160,7 +366148,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -358168,13 +366160,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -358357,8 +366353,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -358400,8 +366396,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -358421,8 +366417,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -358432,7 +366428,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -358556,13 +366556,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -358570,8 +366570,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -358661,8 +366661,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -358754,7 +366754,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -359004,13 +367008,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -359113,7 +367117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -359134,8 +367142,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -359144,8 +367152,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -359177,8 +367185,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -359229,8 +367237,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -359247,7 +367255,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -359275,7 +367287,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -359308,7 +367320,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -359330,7 +367342,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -359377,7 +367389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -359399,8 +367415,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -359416,7 +367432,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -359424,13 +367444,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -359613,8 +367637,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -359656,8 +367680,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -359677,8 +367701,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -359688,7 +367712,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -359812,13 +367840,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -359826,8 +367854,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -359917,8 +367945,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -360010,7 +368038,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -360260,13 +368292,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -360369,7 +368401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -360390,8 +368426,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -360400,8 +368436,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -360433,8 +368469,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -360485,8 +368521,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -360503,7 +368539,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -360531,7 +368571,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -360564,7 +368604,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -360586,7 +368626,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -360633,7 +368673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -360655,8 +368699,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -360672,7 +368716,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -360680,13 +368728,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -360869,8 +368921,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -360912,8 +368964,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -360933,8 +368985,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -360944,7 +368996,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -361068,13 +369124,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -361082,8 +369138,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -361173,8 +369229,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -361266,7 +369322,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -361516,13 +369576,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -361625,7 +369685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -361646,8 +369710,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -361656,8 +369720,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -361689,8 +369753,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -361741,8 +369805,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -361759,7 +369823,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -361787,7 +369855,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -361820,7 +369888,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -361842,7 +369910,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -361889,7 +369957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -361911,8 +369983,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -361928,7 +370000,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -361936,13 +370012,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -362125,8 +370205,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -362168,8 +370248,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -362189,8 +370269,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -362200,7 +370280,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -362324,13 +370408,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -362338,8 +370422,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -362429,8 +370513,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -362522,7 +370606,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -362772,13 +370860,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -362881,7 +370969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -362902,8 +370994,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -362912,8 +371004,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -362945,8 +371037,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -362997,8 +371089,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -363015,7 +371107,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -363043,7 +371139,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -363076,7 +371172,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -363098,7 +371194,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -363145,7 +371241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -363167,8 +371267,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -363184,7 +371284,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -363192,13 +371296,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -363381,8 +371489,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -363424,8 +371532,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -363445,8 +371553,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -363456,7 +371564,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -363580,13 +371692,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -363594,8 +371706,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -363685,8 +371797,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -363778,7 +371890,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -364028,13 +372144,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -364137,7 +372253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -364158,8 +372278,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -364168,8 +372288,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -364201,8 +372321,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -364253,8 +372373,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -364271,7 +372391,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -364299,7 +372423,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -364332,7 +372456,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -364354,7 +372478,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -364401,7 +372525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -364423,8 +372551,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -364440,7 +372568,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -364448,13 +372580,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -364637,8 +372773,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -364680,8 +372816,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -364701,8 +372837,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -364712,7 +372848,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -364836,13 +372976,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -364850,8 +372990,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -364941,8 +373081,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -365034,7 +373174,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -365284,13 +373428,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -365393,7 +373537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -365414,8 +373562,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -365424,8 +373572,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -365457,8 +373605,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -365509,8 +373657,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -365527,7 +373675,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -365555,7 +373707,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -365588,7 +373740,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -365610,7 +373762,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -365657,7 +373809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -365679,8 +373835,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -365696,7 +373852,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -365704,13 +373864,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -365893,8 +374057,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -365936,8 +374100,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -365957,8 +374121,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -365968,7 +374132,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -366092,13 +374260,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -366106,8 +374274,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -366197,8 +374365,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -366290,7 +374458,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -366540,13 +374712,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -366649,7 +374821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -366670,8 +374846,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -366680,8 +374856,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -366713,8 +374889,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -366765,8 +374941,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -366783,7 +374959,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -366811,7 +374991,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -366844,7 +375024,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -366866,7 +375046,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -366913,7 +375093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -366935,8 +375119,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -366952,7 +375136,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -366960,13 +375148,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -367149,8 +375341,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -367192,8 +375384,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -367213,8 +375405,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -367224,7 +375416,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -367348,13 +375544,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -367362,8 +375558,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -367453,8 +375649,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -367546,7 +375742,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -367796,13 +375996,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -367905,7 +376105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -367926,8 +376130,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -367936,8 +376140,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -367969,8 +376173,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -368021,8 +376225,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -368039,7 +376243,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -368067,7 +376275,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -368100,7 +376308,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -368122,7 +376330,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -368169,7 +376377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -368191,8 +376403,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -368208,7 +376420,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -368216,13 +376432,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -368405,8 +376625,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -368448,8 +376668,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -368469,8 +376689,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -368480,7 +376700,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -368604,13 +376828,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -368618,8 +376842,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -368709,8 +376933,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -368802,7 +377026,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -369052,13 +377280,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -369161,7 +377389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -369182,8 +377414,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -369192,8 +377424,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -369225,8 +377457,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -369277,8 +377509,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -369295,7 +377527,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -369323,7 +377559,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -369356,7 +377592,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -369378,7 +377614,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -369425,7 +377661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -369447,8 +377687,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -369464,7 +377704,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -369472,13 +377716,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -369661,8 +377909,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -369704,8 +377952,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -369725,8 +377973,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -369736,7 +377984,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -369860,13 +378112,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -369874,8 +378126,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -369965,8 +378217,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -370058,7 +378310,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -370308,13 +378564,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -370417,7 +378673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -370438,8 +378698,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -370448,8 +378708,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -370481,8 +378741,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -370533,8 +378793,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -370551,7 +378811,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -370579,7 +378843,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -370612,7 +378876,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -370634,7 +378898,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -370681,7 +378945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -370703,8 +378971,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -370720,7 +378988,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -370728,13 +379000,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -370917,8 +379193,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -370960,8 +379236,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -370981,8 +379257,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -370992,7 +379268,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -371116,13 +379396,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -371130,8 +379410,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -371221,8 +379501,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -371314,7 +379594,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -371564,13 +379848,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -371673,7 +379957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -371694,8 +379982,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -371704,8 +379992,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -371737,8 +380025,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -371789,8 +380077,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -371807,7 +380095,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -371835,7 +380127,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -371868,7 +380160,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -371890,7 +380182,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -371937,7 +380229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -371959,8 +380255,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -371976,7 +380272,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -371984,13 +380284,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -372173,8 +380477,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -372216,8 +380520,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -372237,8 +380541,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -372248,7 +380552,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -372372,13 +380680,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -372386,8 +380694,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -372477,8 +380785,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -372570,7 +380878,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -372820,13 +381132,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -372929,7 +381241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -372950,8 +381266,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -372960,8 +381276,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -372993,8 +381309,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -373045,8 +381361,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -373063,7 +381379,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -373091,7 +381411,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -373124,7 +381444,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -373146,7 +381466,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -373193,7 +381513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -373215,8 +381539,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -373232,7 +381556,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -373240,13 +381568,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -373429,8 +381761,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -373472,8 +381804,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -373493,8 +381825,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -373504,7 +381836,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -373628,13 +381964,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -373642,8 +381978,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -373733,8 +382069,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -373826,7 +382162,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -374076,13 +382416,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -374185,7 +382525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -374206,8 +382550,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -374216,8 +382560,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -374249,8 +382593,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -374301,8 +382645,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -374319,7 +382663,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -374347,7 +382695,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -374380,7 +382728,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -374402,7 +382750,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -374449,7 +382797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -374471,8 +382823,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -374488,7 +382840,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -374496,13 +382852,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -374685,8 +383045,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -374728,8 +383088,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -374749,8 +383109,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -374760,7 +383120,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -374884,13 +383248,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -374898,8 +383262,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -374989,8 +383353,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -375082,7 +383446,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -375332,13 +383700,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -375441,7 +383809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -375462,8 +383834,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -375472,8 +383844,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -375505,8 +383877,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -375557,8 +383929,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -375575,7 +383947,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -375603,7 +383979,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -375636,7 +384012,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -375658,7 +384034,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -375705,7 +384081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -375727,8 +384107,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -375744,7 +384124,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -375752,13 +384136,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -375941,8 +384329,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -375984,8 +384372,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -376005,8 +384393,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -376016,7 +384404,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -376140,13 +384532,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -376154,8 +384546,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -376245,8 +384637,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -376338,7 +384730,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -376588,13 +384984,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -376697,7 +385093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -376718,8 +385118,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -376728,8 +385128,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -376761,8 +385161,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -376813,8 +385213,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -376831,7 +385231,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -376859,7 +385263,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -376892,7 +385296,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -376914,7 +385318,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -376961,7 +385365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -376983,8 +385391,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -377000,7 +385408,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -377008,13 +385420,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -377197,8 +385613,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -377240,8 +385656,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -377261,8 +385677,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -377272,7 +385688,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -377396,13 +385816,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -377410,8 +385830,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -377501,8 +385921,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -377594,7 +386014,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -377844,13 +386268,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -377953,7 +386377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -377974,8 +386402,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -377984,8 +386412,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -378017,8 +386445,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -378069,8 +386497,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -378087,7 +386515,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -378115,7 +386547,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -378148,7 +386580,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -378170,7 +386602,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -378217,7 +386649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -378239,8 +386675,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -378256,7 +386692,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -378264,13 +386704,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -378453,8 +386897,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -378496,8 +386940,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -378517,8 +386961,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -378528,7 +386972,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -378652,13 +387100,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -378666,8 +387114,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -378757,8 +387205,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -378850,7 +387298,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -379100,13 +387552,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -379209,7 +387661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -379230,8 +387686,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -379240,8 +387696,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -379273,8 +387729,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -379325,8 +387781,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -379343,7 +387799,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -379371,7 +387831,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -379404,7 +387864,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -379426,7 +387886,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -379473,7 +387933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -379495,8 +387959,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -379512,7 +387976,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -379520,13 +387988,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -379709,8 +388181,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -379752,8 +388224,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -379773,8 +388245,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -379784,7 +388256,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -379908,13 +388384,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -379922,8 +388398,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -380013,8 +388489,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -380106,7 +388582,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -380356,13 +388836,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -380465,7 +388945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -380486,8 +388970,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -380496,8 +388980,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -380529,8 +389013,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -380581,8 +389065,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -380599,7 +389083,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -380627,7 +389115,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -380660,7 +389148,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -380682,7 +389170,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -380729,7 +389217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -380751,8 +389243,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -380768,7 +389260,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -380776,13 +389272,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -380965,8 +389465,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -381008,8 +389508,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -381029,8 +389529,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -381040,7 +389540,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -381164,13 +389668,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -381178,8 +389682,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -381269,8 +389773,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -381362,7 +389866,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -381612,13 +390120,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -381721,7 +390229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -381742,8 +390254,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -381752,8 +390264,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -381785,8 +390297,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -381837,8 +390349,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -381855,7 +390367,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -381883,7 +390399,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -381916,7 +390432,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -381938,7 +390454,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -381985,7 +390501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -382007,8 +390527,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -382024,7 +390544,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -382032,13 +390556,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -382221,8 +390749,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -382264,8 +390792,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -382285,8 +390813,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -382296,7 +390824,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -382420,13 +390952,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -382434,8 +390966,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -382525,8 +391057,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -382618,7 +391150,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -382868,13 +391404,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -382977,7 +391513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -382998,8 +391538,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -383008,8 +391548,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -383041,8 +391581,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -383093,8 +391633,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -383111,7 +391651,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -383139,7 +391683,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -383172,7 +391716,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -383194,7 +391738,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -383241,7 +391785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -383263,8 +391811,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -383280,7 +391828,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -383288,13 +391840,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -383477,8 +392033,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -383520,8 +392076,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -383541,8 +392097,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -383552,7 +392108,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -383676,13 +392236,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -383690,8 +392250,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -383781,8 +392341,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -383874,7 +392434,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -384124,13 +392688,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -384233,7 +392797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -384254,8 +392822,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -384264,8 +392832,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -384297,8 +392865,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -384349,8 +392917,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -384367,7 +392935,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -384395,7 +392967,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -384428,7 +393000,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -384450,7 +393022,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -384497,7 +393069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -384519,8 +393095,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -384536,7 +393112,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -384544,13 +393124,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -384733,8 +393317,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -384776,8 +393360,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -384797,8 +393381,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -384808,7 +393392,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -384932,13 +393520,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -384946,8 +393534,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -385037,8 +393625,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -385130,7 +393718,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -385380,13 +393972,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -385489,7 +394081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -385510,8 +394106,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -385520,8 +394116,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -385553,8 +394149,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -385605,8 +394201,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -385623,7 +394219,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -385651,7 +394251,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -385684,7 +394284,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -385706,7 +394306,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -385753,7 +394353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -385775,8 +394379,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -385792,7 +394396,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -385800,13 +394408,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -385989,8 +394601,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -386032,8 +394644,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -386053,8 +394665,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -386064,7 +394676,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -386188,13 +394804,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -386202,8 +394818,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -386293,8 +394909,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -386386,7 +395002,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -386636,13 +395256,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -386745,7 +395365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -386766,8 +395390,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -386776,8 +395400,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -386809,8 +395433,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -386861,8 +395485,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -386879,7 +395503,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -386907,7 +395535,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -386940,7 +395568,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -386962,7 +395590,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -387009,7 +395637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -387031,8 +395663,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -387048,7 +395680,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -387056,13 +395692,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -387245,8 +395885,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -387288,8 +395928,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -387309,8 +395949,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -387320,7 +395960,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -387444,13 +396088,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -387458,8 +396102,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -387549,8 +396193,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -387642,7 +396286,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -387892,13 +396540,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -388001,7 +396649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -388022,8 +396674,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -388032,8 +396684,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -388065,8 +396717,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -388117,8 +396769,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -388135,7 +396787,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -388163,7 +396819,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -388196,7 +396852,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -388218,7 +396874,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -388265,7 +396921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -388287,8 +396947,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -388304,7 +396964,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -388312,13 +396976,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -388501,8 +397169,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -388544,8 +397212,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -388565,8 +397233,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -388576,7 +397244,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -388700,13 +397372,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -388714,8 +397386,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -388805,8 +397477,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -388898,7 +397570,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -389148,13 +397824,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -389257,7 +397933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -389278,8 +397958,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -389288,8 +397968,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -389321,8 +398001,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -389373,8 +398053,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -389391,7 +398071,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -389419,7 +398103,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -389452,7 +398136,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -389474,7 +398158,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -389521,7 +398205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -389543,8 +398231,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -389560,7 +398248,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -389568,13 +398260,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -389757,8 +398453,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -389800,8 +398496,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -389821,8 +398517,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -389832,7 +398528,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -389956,13 +398656,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -389970,8 +398670,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -390061,8 +398761,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -390154,7 +398854,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -390404,13 +399108,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -390513,7 +399217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -390534,8 +399242,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -390544,8 +399252,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -390577,8 +399285,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -390629,8 +399337,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -390647,7 +399355,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -390675,7 +399387,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -390708,7 +399420,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -390730,7 +399442,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -390777,7 +399489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -390799,8 +399515,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -390816,7 +399532,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -390824,13 +399544,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -391013,8 +399737,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -391056,8 +399780,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -391077,8 +399801,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -391088,7 +399812,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -391212,13 +399940,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -391226,8 +399954,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -391317,8 +400045,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -391410,7 +400138,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -391660,13 +400392,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -391769,7 +400501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -391790,8 +400526,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -391800,8 +400536,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -391833,8 +400569,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -391885,8 +400621,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -391903,7 +400639,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -391931,7 +400671,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -391964,7 +400704,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -391986,7 +400726,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -392033,7 +400773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -392055,8 +400799,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -392072,7 +400816,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -392080,13 +400828,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -392269,8 +401021,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -392312,8 +401064,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -392333,8 +401085,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -392344,7 +401096,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -392468,13 +401224,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -392482,8 +401238,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -392573,8 +401329,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -392666,7 +401422,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -392916,13 +401676,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -393025,7 +401785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -393046,8 +401810,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -393056,8 +401820,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -393089,8 +401853,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -393141,8 +401905,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -393159,7 +401923,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -393187,7 +401955,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -393220,7 +401988,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -393242,7 +402010,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -393289,7 +402057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -393311,8 +402083,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -393328,7 +402100,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -393336,13 +402112,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -393525,8 +402305,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -393568,8 +402348,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -393589,8 +402369,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -393600,7 +402380,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -393724,13 +402508,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -393738,8 +402522,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -393829,8 +402613,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -393922,7 +402706,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -394172,13 +402960,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -394281,7 +403069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -394302,8 +403094,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -394312,8 +403104,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -394345,8 +403137,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -394397,8 +403189,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -394415,7 +403207,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -394443,7 +403239,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -394476,7 +403272,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -394498,7 +403294,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -394545,7 +403341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -394567,8 +403367,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -394584,7 +403384,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -394592,13 +403396,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -394781,8 +403589,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -394824,8 +403632,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -394845,8 +403653,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -394856,7 +403664,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -394980,13 +403792,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -394994,8 +403806,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -395085,8 +403897,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -395178,7 +403990,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -395428,13 +404244,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -395537,7 +404353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -395558,8 +404378,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -395568,8 +404388,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -395601,8 +404421,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -395653,8 +404473,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -395671,7 +404491,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -395699,7 +404523,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -395732,7 +404556,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -395754,7 +404578,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -395801,7 +404625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -395823,8 +404651,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -395840,7 +404668,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -395848,13 +404680,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -396037,8 +404873,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -396080,8 +404916,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -396101,8 +404937,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -396112,7 +404948,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -396236,13 +405076,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -396250,8 +405090,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -396341,8 +405181,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -396434,7 +405274,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -396684,13 +405528,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -396793,7 +405637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -396814,8 +405662,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -396824,8 +405672,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -396857,8 +405705,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -396909,8 +405757,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -396927,7 +405775,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -396955,7 +405807,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -396988,7 +405840,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -397010,7 +405862,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -397057,7 +405909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -397079,8 +405935,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -397096,7 +405952,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -397104,13 +405964,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -397293,8 +406157,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -397336,8 +406200,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -397357,8 +406221,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -397368,7 +406232,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -397492,13 +406360,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -397506,8 +406374,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -397597,8 +406465,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -397690,7 +406558,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -397940,13 +406812,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -398049,7 +406921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -398070,8 +406946,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -398080,8 +406956,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -398113,8 +406989,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -398165,8 +407041,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -398183,7 +407059,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -398211,7 +407091,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -398244,7 +407124,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -398266,7 +407146,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -398313,7 +407193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -398335,8 +407219,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -398352,7 +407236,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -398360,13 +407248,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -398549,8 +407441,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -398592,8 +407484,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -398613,8 +407505,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -398624,7 +407516,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -398748,13 +407644,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -398762,8 +407658,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -398853,8 +407749,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -398946,7 +407842,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -399196,13 +408096,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -399305,7 +408205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -399326,8 +408230,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -399336,8 +408240,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -399369,8 +408273,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -399421,8 +408325,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -399439,7 +408343,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -399467,7 +408375,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -399500,7 +408408,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -399522,7 +408430,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -399569,7 +408477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -399591,8 +408503,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -399608,7 +408520,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -399616,13 +408532,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -399805,8 +408725,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -399848,8 +408768,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -399869,8 +408789,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -399880,7 +408800,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -400004,13 +408928,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -400018,8 +408942,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -400109,8 +409033,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -400202,7 +409126,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -400452,13 +409380,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -400561,7 +409489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -400582,8 +409514,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -400592,8 +409524,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -400625,8 +409557,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -400677,8 +409609,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -400695,7 +409627,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -400723,7 +409659,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -400756,7 +409692,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -400778,7 +409714,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -400825,7 +409761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -400847,8 +409787,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -400864,7 +409804,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -400872,13 +409816,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -401061,8 +410009,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -401104,8 +410052,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -401125,8 +410073,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -401136,7 +410084,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -401260,13 +410212,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -401274,8 +410226,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -401365,8 +410317,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -401458,7 +410410,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -401708,13 +410664,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -401817,7 +410773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -401838,8 +410798,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -401848,8 +410808,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -401881,8 +410841,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -401933,8 +410893,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -401951,7 +410911,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -401979,7 +410943,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -402012,7 +410976,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -402034,7 +410998,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -402081,7 +411045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -402103,8 +411071,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -402120,7 +411088,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -402128,13 +411100,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -402317,8 +411293,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -402360,8 +411336,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -402381,8 +411357,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -402392,7 +411368,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -402516,13 +411496,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -402530,8 +411510,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -402621,8 +411601,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -402714,7 +411694,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -402964,13 +411948,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -403073,7 +412057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -403094,8 +412082,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -403104,8 +412092,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -403137,8 +412125,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -403189,8 +412177,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -403207,7 +412195,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -403235,7 +412227,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -403268,7 +412260,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -403290,7 +412282,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -403337,7 +412329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -403359,8 +412355,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -403376,7 +412372,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -403384,13 +412384,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -403573,8 +412577,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -403616,8 +412620,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -403637,8 +412641,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -403648,7 +412652,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -403772,13 +412780,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -403786,8 +412794,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -403877,8 +412885,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -403970,7 +412978,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -404220,13 +413232,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -404329,7 +413341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -404350,8 +413366,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -404360,8 +413376,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -404393,8 +413409,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -404445,8 +413461,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -404463,7 +413479,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -404491,7 +413511,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -404524,7 +413544,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -404546,7 +413566,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -404593,7 +413613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -404615,8 +413639,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -404632,7 +413656,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -404640,13 +413668,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -404829,8 +413861,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -404872,8 +413904,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -404893,8 +413925,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -404904,7 +413936,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -405028,13 +414064,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -405042,8 +414078,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -405133,8 +414169,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -405226,7 +414262,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -405476,13 +414516,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -405585,7 +414625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -405606,8 +414650,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -405616,8 +414660,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -405649,8 +414693,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -405701,8 +414745,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -405719,7 +414763,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -405747,7 +414795,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -405780,7 +414828,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -405802,7 +414850,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -405849,7 +414897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -405871,8 +414923,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -405888,7 +414940,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -405896,13 +414952,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -406085,8 +415145,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -406128,8 +415188,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -406149,8 +415209,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -406160,7 +415220,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -406284,13 +415348,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -406298,8 +415362,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -406389,8 +415453,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -406482,7 +415546,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -406732,13 +415800,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -406841,7 +415909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -406862,8 +415934,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -406872,8 +415944,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -406905,8 +415977,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -406957,8 +416029,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -406975,7 +416047,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -407003,7 +416079,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -407036,7 +416112,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -407058,7 +416134,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -407105,7 +416181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -407127,8 +416207,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -407144,7 +416224,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -407152,13 +416236,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -407341,8 +416429,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -407384,8 +416472,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -407405,8 +416493,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -407416,7 +416504,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -407540,13 +416632,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -407554,8 +416646,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -407645,8 +416737,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -407738,7 +416830,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -407988,13 +417084,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -408097,7 +417193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -408118,8 +417218,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -408128,8 +417228,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -408161,8 +417261,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -408213,8 +417313,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -408231,7 +417331,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -408259,7 +417363,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -408292,7 +417396,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -408314,7 +417418,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -408361,7 +417465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -408383,8 +417491,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -408400,7 +417508,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -408408,13 +417520,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -408597,8 +417713,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -408640,8 +417756,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -408661,8 +417777,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -408672,7 +417788,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -408796,13 +417916,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -408810,8 +417930,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -408901,8 +418021,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -408994,7 +418114,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -409244,13 +418368,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -409353,7 +418477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -409374,8 +418502,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -409384,8 +418512,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -409417,8 +418545,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -409469,8 +418597,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -409487,7 +418615,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -409515,7 +418647,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -409548,7 +418680,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -409570,7 +418702,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -409617,7 +418749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -409639,8 +418775,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -409656,7 +418792,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -409664,13 +418804,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -409853,8 +418997,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -409896,8 +419040,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -409917,8 +419061,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -409928,7 +419072,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -410052,13 +419200,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -410066,8 +419214,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -410157,8 +419305,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -410250,7 +419398,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -410500,13 +419652,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -410609,7 +419761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -410630,8 +419786,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -410640,8 +419796,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -410673,8 +419829,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -410725,8 +419881,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -410743,7 +419899,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -410771,7 +419931,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -410804,7 +419964,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -410826,7 +419986,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -410873,7 +420033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -410895,8 +420059,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -410912,7 +420076,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -410920,13 +420088,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -411109,8 +420281,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -411152,8 +420324,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -411173,8 +420345,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -411184,7 +420356,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -411308,13 +420484,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -411322,8 +420498,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -411413,8 +420589,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -411506,7 +420682,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -411756,13 +420936,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -411865,7 +421045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -411886,8 +421070,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -411896,8 +421080,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -411929,8 +421113,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -411981,8 +421165,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -411999,7 +421183,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -412027,7 +421215,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -412060,7 +421248,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -412082,7 +421270,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -412129,7 +421317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -412151,8 +421343,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -412168,7 +421360,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -412176,13 +421372,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -412365,8 +421565,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -412408,8 +421608,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -412429,8 +421629,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -412440,7 +421640,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -412564,13 +421768,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -412578,8 +421782,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -412669,8 +421873,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -412762,7 +421966,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -413012,13 +422220,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -413121,7 +422329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -413142,8 +422354,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -413152,8 +422364,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -413185,8 +422397,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -413237,8 +422449,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -413255,7 +422467,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -413283,7 +422499,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -413316,7 +422532,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -413338,7 +422554,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -413385,7 +422601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -413407,8 +422627,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -413424,7 +422644,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -413432,13 +422656,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -413621,8 +422849,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -413664,8 +422892,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -413685,8 +422913,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -413696,7 +422924,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -413820,13 +423052,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -413834,8 +423066,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -413925,8 +423157,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -414018,7 +423250,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -414268,13 +423504,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -414377,7 +423613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -414398,8 +423638,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -414408,8 +423648,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -414441,8 +423681,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -414493,8 +423733,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -414511,7 +423751,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -414539,7 +423783,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -414572,7 +423816,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -414594,7 +423838,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -414641,7 +423885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -414663,8 +423911,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -414680,7 +423928,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -414688,13 +423940,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -414877,8 +424133,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -414920,8 +424176,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -414941,8 +424197,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -414952,7 +424208,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -415076,13 +424336,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -415090,8 +424350,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -415181,8 +424441,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -415274,7 +424534,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -415524,13 +424788,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -415633,7 +424897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -415654,8 +424922,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -415664,8 +424932,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -415697,8 +424965,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -415749,8 +425017,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -415767,7 +425035,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -415795,7 +425067,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -415828,7 +425100,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -415850,7 +425122,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -415897,7 +425169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -415919,8 +425195,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -415936,7 +425212,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -415944,13 +425224,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -416133,8 +425417,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -416176,8 +425460,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -416197,8 +425481,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -416208,7 +425492,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -416332,13 +425620,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -416346,8 +425634,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -416437,8 +425725,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -416530,7 +425818,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -416780,13 +426072,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -416889,7 +426181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -416910,8 +426206,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -416920,8 +426216,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -416953,8 +426249,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -417005,8 +426301,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -417023,7 +426319,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -417051,7 +426351,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -417084,7 +426384,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -417106,7 +426406,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -417153,7 +426453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -417175,8 +426479,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -417192,7 +426496,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -417200,13 +426508,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -417389,8 +426701,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -417432,8 +426744,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -417453,8 +426765,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -417464,7 +426776,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -417588,13 +426904,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -417602,8 +426918,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -417693,8 +427009,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -417786,7 +427102,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -418036,13 +427356,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -418145,7 +427465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -418166,8 +427490,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -418176,8 +427500,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -418209,8 +427533,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -418261,8 +427585,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -418279,7 +427603,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -418307,7 +427635,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -418340,7 +427668,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -418362,7 +427690,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -418409,7 +427737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -418431,8 +427763,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -418448,7 +427780,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -418456,13 +427792,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -418645,8 +427985,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -418688,8 +428028,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -418709,8 +428049,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -418720,7 +428060,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -418844,13 +428188,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -418858,8 +428202,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -418949,8 +428293,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -419042,7 +428386,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -419292,13 +428640,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -419401,7 +428749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -419422,8 +428774,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -419432,8 +428784,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -419465,8 +428817,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -419517,8 +428869,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -419535,7 +428887,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -419563,7 +428919,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -419596,7 +428952,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -419618,7 +428974,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -419665,7 +429021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -419687,8 +429047,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -419704,7 +429064,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -419712,13 +429076,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -419901,8 +429269,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -419944,8 +429312,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -419965,8 +429333,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -419976,7 +429344,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -420100,13 +429472,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -420114,8 +429486,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -420205,8 +429577,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -420298,7 +429670,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -420548,13 +429924,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -420657,7 +430033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -420678,8 +430058,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -420688,8 +430068,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -420721,8 +430101,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -420773,8 +430153,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -420791,7 +430171,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -420819,7 +430203,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -420852,7 +430236,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -420874,7 +430258,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -420921,7 +430305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -420943,8 +430331,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -420960,7 +430348,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -420968,13 +430360,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -421157,8 +430553,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -421200,8 +430596,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -421221,8 +430617,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -421232,7 +430628,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -421356,13 +430756,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -421370,8 +430770,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -421461,8 +430861,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -421554,7 +430954,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -421804,13 +431208,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -421913,7 +431317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -421934,8 +431342,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -421944,8 +431352,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -421977,8 +431385,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -422029,8 +431437,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -422047,7 +431455,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -422075,7 +431487,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -422108,7 +431520,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -422130,7 +431542,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -422177,7 +431589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -422199,8 +431615,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -422216,7 +431632,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -422224,13 +431644,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -422413,8 +431837,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -422456,8 +431880,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -422477,8 +431901,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -422488,7 +431912,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -422612,13 +432040,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -422626,8 +432054,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -422717,8 +432145,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -422810,7 +432238,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -423060,13 +432492,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -423169,7 +432601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -423190,8 +432626,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -423200,8 +432636,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -423233,8 +432669,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -423285,8 +432721,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -423303,7 +432739,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -423331,7 +432771,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -423364,7 +432804,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -423386,7 +432826,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -423433,7 +432873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -423455,8 +432899,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -423472,7 +432916,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -423480,13 +432928,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -423669,8 +433121,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -423712,8 +433164,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -423733,8 +433185,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -423744,7 +433196,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -423868,13 +433324,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -423882,8 +433338,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -423973,8 +433429,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -424066,7 +433522,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -424316,13 +433776,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -424425,7 +433885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -424446,8 +433910,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -424456,8 +433920,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -424489,8 +433953,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -424541,8 +434005,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -424559,7 +434023,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -424587,7 +434055,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -424620,7 +434088,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -424642,7 +434110,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -424689,7 +434157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -424711,8 +434183,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -424728,7 +434200,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -424736,13 +434212,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -424925,8 +434405,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -424968,8 +434448,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -424989,8 +434469,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -425000,7 +434480,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -425124,13 +434608,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -425138,8 +434622,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -425229,8 +434713,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -425322,7 +434806,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -425572,13 +435060,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -425681,7 +435169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -425702,8 +435194,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -425712,8 +435204,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -425745,8 +435237,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -425797,8 +435289,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -425815,7 +435307,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -425843,7 +435339,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -425876,7 +435372,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -425898,7 +435394,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -425945,7 +435441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -425967,8 +435467,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -425984,7 +435484,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -425992,13 +435496,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -426181,8 +435689,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -426224,8 +435732,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -426245,8 +435753,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -426256,7 +435764,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -426380,13 +435892,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -426394,8 +435906,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -426485,8 +435997,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -426578,7 +436090,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -426828,13 +436344,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -426937,7 +436453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -426958,8 +436478,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -426968,8 +436488,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -427001,8 +436521,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -427053,8 +436573,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -427071,7 +436591,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -427099,7 +436623,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -427132,7 +436656,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -427154,7 +436678,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -427201,7 +436725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -427223,8 +436751,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -427240,7 +436768,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -427248,13 +436780,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -427437,8 +436973,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -427480,8 +437016,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -427501,8 +437037,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -427512,7 +437048,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -427636,13 +437176,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -427650,8 +437190,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -427741,8 +437281,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -427834,7 +437374,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -428084,13 +437628,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -428193,7 +437737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -428214,8 +437762,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -428224,8 +437772,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -428257,8 +437805,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -428309,8 +437857,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -428327,7 +437875,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -428355,7 +437907,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -428388,7 +437940,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -428410,7 +437962,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -428457,7 +438009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -428479,8 +438035,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -428496,7 +438052,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -428504,13 +438064,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -428693,8 +438257,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -428736,8 +438300,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -428757,8 +438321,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -428768,7 +438332,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -428892,13 +438460,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -428906,8 +438474,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -428997,8 +438565,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -429090,7 +438658,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -429340,13 +438912,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -429449,7 +439021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -429470,8 +439046,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -429480,8 +439056,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -429513,8 +439089,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -429565,8 +439141,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -429583,7 +439159,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -429611,7 +439191,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -429644,7 +439224,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -429666,7 +439246,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -429713,7 +439293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -429735,8 +439319,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -429752,7 +439336,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -429760,13 +439348,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -429949,8 +439541,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -429992,8 +439584,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -430013,8 +439605,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -430024,7 +439616,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -430148,13 +439744,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -430162,8 +439758,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -430253,8 +439849,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -430346,7 +439942,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -430596,13 +440196,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -430705,7 +440305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -430726,8 +440330,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -430736,8 +440340,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -430769,8 +440373,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -430821,8 +440425,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -430839,7 +440443,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -430867,7 +440475,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -430900,7 +440508,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -430922,7 +440530,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -430969,7 +440577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -430991,8 +440603,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -431008,7 +440620,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -431016,13 +440632,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -431205,8 +440825,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -431248,8 +440868,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -431269,8 +440889,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -431280,7 +440900,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -431404,13 +441028,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -431418,8 +441042,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -431509,8 +441133,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -431602,7 +441226,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -431852,13 +441480,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -431961,7 +441589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -431982,8 +441614,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -431992,8 +441624,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -432025,8 +441657,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -432077,8 +441709,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -432095,7 +441727,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -432123,7 +441759,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -432156,7 +441792,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -432178,7 +441814,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -432225,7 +441861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -432247,8 +441887,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -432264,7 +441904,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -432272,13 +441916,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -432461,8 +442109,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -432504,8 +442152,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -432525,8 +442173,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -432536,7 +442184,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -432660,13 +442312,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -432674,8 +442326,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -432765,8 +442417,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -432858,7 +442510,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -433108,13 +442764,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -433217,7 +442873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -433238,8 +442898,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -433248,8 +442908,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -433281,8 +442941,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -433333,8 +442993,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -433351,7 +443011,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -433379,7 +443043,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -433412,7 +443076,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -433434,7 +443098,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -433481,7 +443145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -433503,8 +443171,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -433520,7 +443188,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -433528,13 +443200,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -433717,8 +443393,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -433760,8 +443436,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -433781,8 +443457,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -433792,7 +443468,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -433916,13 +443596,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -433930,8 +443610,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -434021,8 +443701,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -434114,7 +443794,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -434364,13 +444048,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -434473,7 +444157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -434494,8 +444182,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -434504,8 +444192,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -434537,8 +444225,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -434589,8 +444277,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -434607,7 +444295,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -434635,7 +444327,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -434668,7 +444360,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -434690,7 +444382,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -434737,7 +444429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -434759,8 +444455,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -434776,7 +444472,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -434784,13 +444484,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -434973,8 +444677,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -435016,8 +444720,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -435037,8 +444741,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -435048,7 +444752,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -435172,13 +444880,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -435186,8 +444894,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -435277,8 +444985,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -435370,7 +445078,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -435620,13 +445332,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -435729,7 +445441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -435750,8 +445466,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -435760,8 +445476,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -435793,8 +445509,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -435845,8 +445561,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -435863,7 +445579,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -435891,7 +445611,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -435924,7 +445644,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -435946,7 +445666,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -435993,7 +445713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -436015,8 +445739,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -436032,7 +445756,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -436040,13 +445768,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -436229,8 +445961,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -436272,8 +446004,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -436293,8 +446025,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -436304,7 +446036,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -436428,13 +446164,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -436442,8 +446178,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -436533,8 +446269,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -436626,7 +446362,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -436876,13 +446616,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -436985,7 +446725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -437006,8 +446750,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -437016,8 +446760,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -437049,8 +446793,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -437101,8 +446845,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -437119,7 +446863,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -437147,7 +446895,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -437180,7 +446928,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -437202,7 +446950,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -437249,7 +446997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -437271,8 +447023,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -437288,7 +447040,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -437296,13 +447052,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -437485,8 +447245,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -437528,8 +447288,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -437549,8 +447309,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -437560,7 +447320,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -437684,13 +447448,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -437698,8 +447462,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -437789,8 +447553,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -437882,7 +447646,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -438132,13 +447900,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -438241,7 +448009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -438262,8 +448034,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -438272,8 +448044,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -438305,8 +448077,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -438357,8 +448129,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -438375,7 +448147,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -438403,7 +448179,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -438436,7 +448212,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -438458,7 +448234,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -438505,7 +448281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -438527,8 +448307,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -438544,7 +448324,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -438552,13 +448336,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -438741,8 +448529,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -438784,8 +448572,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -438805,8 +448593,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -438816,7 +448604,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -438940,13 +448732,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -438954,8 +448746,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -439045,8 +448837,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -439138,7 +448930,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -439388,13 +449184,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -439497,7 +449293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -439518,8 +449318,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -439528,8 +449328,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -439561,8 +449361,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -439613,8 +449413,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -439631,7 +449431,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -439659,7 +449463,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -439692,7 +449496,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -439714,7 +449518,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -439761,7 +449565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -439783,8 +449591,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -439800,7 +449608,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -439808,13 +449620,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -439997,8 +449813,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -440040,8 +449856,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -440061,8 +449877,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -440072,7 +449888,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -440196,13 +450016,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -440210,8 +450030,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -440301,8 +450121,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -440394,7 +450214,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -440644,13 +450468,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -440753,7 +450577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -440774,8 +450602,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -440784,8 +450612,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -440817,8 +450645,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -440869,8 +450697,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -440887,7 +450715,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -440915,7 +450747,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -440948,7 +450780,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -440970,7 +450802,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -441017,7 +450849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -441039,8 +450875,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -441056,7 +450892,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -441064,13 +450904,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -441253,8 +451097,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -441296,8 +451140,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -441317,8 +451161,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -441328,7 +451172,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -441452,13 +451300,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -441466,8 +451314,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -441557,8 +451405,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -441650,7 +451498,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -441900,13 +451752,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -442009,7 +451861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -442030,8 +451886,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -442040,8 +451896,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -442073,8 +451929,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -442125,8 +451981,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -442143,7 +451999,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -442171,7 +452031,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -442204,7 +452064,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -442226,7 +452086,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -442273,7 +452133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -442295,8 +452159,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -442312,7 +452176,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -442320,13 +452188,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -442509,8 +452381,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -442552,8 +452424,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -442573,8 +452445,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -442584,7 +452456,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -442708,13 +452584,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -442722,8 +452598,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -442813,8 +452689,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -442906,7 +452782,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -443156,13 +453036,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -443265,7 +453145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -443286,8 +453170,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -443296,8 +453180,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -443329,8 +453213,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -443381,8 +453265,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -443399,7 +453283,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -443427,7 +453315,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -443460,7 +453348,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -443482,7 +453370,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -443529,7 +453417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -443551,8 +453443,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -443568,7 +453460,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -443576,13 +453472,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -443765,8 +453665,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -443808,8 +453708,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -443829,8 +453729,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -443840,7 +453740,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -443964,13 +453868,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -443978,8 +453882,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -444069,8 +453973,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -444162,7 +454066,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -444412,13 +454320,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -444521,7 +454429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -444542,8 +454454,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -444552,8 +454464,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -444585,8 +454497,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -444637,8 +454549,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -444655,7 +454567,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -444683,7 +454599,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -444716,7 +454632,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -444738,7 +454654,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -444785,7 +454701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -444807,8 +454727,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -444824,7 +454744,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -444832,13 +454756,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -445021,8 +454949,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -445064,8 +454992,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -445085,8 +455013,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -445096,7 +455024,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -445220,13 +455152,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -445234,8 +455166,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -445325,8 +455257,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -445418,7 +455350,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -445668,13 +455604,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -445777,7 +455713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -445798,8 +455738,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -445808,8 +455748,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -445841,8 +455781,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -445893,8 +455833,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -445911,7 +455851,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -445939,7 +455883,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -445972,7 +455916,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -445994,7 +455938,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -446041,7 +455985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -446063,8 +456011,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -446080,7 +456028,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -446088,13 +456040,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -446277,8 +456233,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -446320,8 +456276,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -446341,8 +456297,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -446352,7 +456308,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -446476,13 +456436,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -446490,8 +456450,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -446581,8 +456541,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -446674,7 +456634,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -446924,13 +456888,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -447033,7 +456997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -447054,8 +457022,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -447064,8 +457032,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -447097,8 +457065,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -447149,8 +457117,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -447167,7 +457135,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -447195,7 +457167,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -447228,7 +457200,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -447250,7 +457222,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -447297,7 +457269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -447319,8 +457295,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -447336,7 +457312,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -447344,13 +457324,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -447533,8 +457517,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -447576,8 +457560,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -447597,8 +457581,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -447608,7 +457592,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -447732,13 +457720,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -447746,8 +457734,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -447837,8 +457825,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -447930,7 +457918,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -448180,13 +458172,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -448289,7 +458281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -448310,8 +458306,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -448320,8 +458316,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -448353,8 +458349,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -448405,8 +458401,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -448423,7 +458419,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -448451,7 +458451,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -448484,7 +458484,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -448506,7 +458506,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -448553,7 +458553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -448575,8 +458579,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -448592,7 +458596,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -448600,13 +458608,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -448789,8 +458801,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -448832,8 +458844,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -448853,8 +458865,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -448864,7 +458876,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -448988,13 +459004,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -449002,8 +459018,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -449093,8 +459109,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -449186,7 +459202,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -449436,13 +459456,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -449545,7 +459565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -449566,8 +459590,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -449576,8 +459600,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -449609,8 +459633,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -449661,8 +459685,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -449679,7 +459703,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -449707,7 +459735,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -449740,7 +459768,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -449762,7 +459790,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -449809,7 +459837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -449831,8 +459863,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -449848,7 +459880,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -449856,13 +459892,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -450045,8 +460085,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -450088,8 +460128,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -450109,8 +460149,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -450120,7 +460160,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -450244,13 +460288,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -450258,8 +460302,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -450349,8 +460393,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -450442,7 +460486,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -450692,13 +460740,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -450801,7 +460849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -450822,8 +460874,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -450832,8 +460884,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -450865,8 +460917,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -450917,8 +460969,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -450935,7 +460987,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -450963,7 +461019,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -450996,7 +461052,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -451018,7 +461074,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -451065,7 +461121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -451087,8 +461147,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -451104,7 +461164,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -451112,13 +461176,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -451301,8 +461369,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -451344,8 +461412,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -451365,8 +461433,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -451376,7 +461444,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -451500,13 +461572,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -451514,8 +461586,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -451605,8 +461677,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -451698,7 +461770,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -451948,13 +462024,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -452057,7 +462133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -452078,8 +462158,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -452088,8 +462168,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -452121,8 +462201,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -452173,8 +462253,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -452191,7 +462271,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -452219,7 +462303,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -452252,7 +462336,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -452274,7 +462358,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -452321,7 +462405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -452343,8 +462431,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -452360,7 +462448,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -452368,13 +462460,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -452557,8 +462653,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -452600,8 +462696,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -452621,8 +462717,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -452632,7 +462728,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -452756,13 +462856,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -452770,8 +462870,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -452861,8 +462961,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -452954,7 +463054,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -453204,13 +463308,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -453313,7 +463417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -453334,8 +463442,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -453344,8 +463452,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -453377,8 +463485,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -453429,8 +463537,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -453447,7 +463555,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -453475,7 +463587,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -453508,7 +463620,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -453530,7 +463642,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -453577,7 +463689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -453599,8 +463715,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -453616,7 +463732,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -453624,13 +463744,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -453813,8 +463937,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -453856,8 +463980,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -453877,8 +464001,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -453888,7 +464012,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -454012,13 +464140,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -454026,8 +464154,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -454117,8 +464245,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -454210,7 +464338,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -454460,13 +464592,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -454569,7 +464701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -454590,8 +464726,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -454600,8 +464736,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -454633,8 +464769,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -454685,8 +464821,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -454703,7 +464839,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -454731,7 +464871,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -454764,7 +464904,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -454786,7 +464926,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -454833,7 +464973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -454855,8 +464999,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -454872,7 +465016,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -454880,13 +465028,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -455069,8 +465221,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -455112,8 +465264,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -455133,8 +465285,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -455144,7 +465296,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -455268,13 +465424,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -455282,8 +465438,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -455373,8 +465529,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -455466,7 +465622,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -455716,13 +465876,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -455825,7 +465985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -455846,8 +466010,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -455856,8 +466020,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -455889,8 +466053,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -455941,8 +466105,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -455959,7 +466123,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -455987,7 +466155,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -456020,7 +466188,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -456042,7 +466210,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -456089,7 +466257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -456111,8 +466283,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -456128,7 +466300,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -456136,13 +466312,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -456325,8 +466505,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -456368,8 +466548,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -456389,8 +466569,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -456400,7 +466580,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -456524,13 +466708,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -456538,8 +466722,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -456629,8 +466813,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -456722,7 +466906,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -456972,13 +467160,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -457081,7 +467269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -457102,8 +467294,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -457112,8 +467304,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -457145,8 +467337,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -457197,8 +467389,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -457215,7 +467407,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -457243,7 +467439,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -457276,7 +467472,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -457298,7 +467494,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -457345,7 +467541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -457367,8 +467567,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -457384,7 +467584,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -457392,13 +467596,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -457581,8 +467789,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -457624,8 +467832,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -457645,8 +467853,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -457656,7 +467864,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -457780,13 +467992,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -457794,8 +468006,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -457885,8 +468097,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -457978,7 +468190,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -458228,13 +468444,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -458337,7 +468553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -458358,8 +468578,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -458368,8 +468588,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -458401,8 +468621,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -458453,8 +468673,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -458471,7 +468691,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -458499,7 +468723,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -458532,7 +468756,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -458554,7 +468778,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -458601,7 +468825,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -458623,8 +468851,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -458640,7 +468868,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -458648,13 +468880,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -458837,8 +469073,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -458880,8 +469116,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -458901,8 +469137,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -458912,7 +469148,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -459036,13 +469276,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -459050,8 +469290,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -459141,8 +469381,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -459234,7 +469474,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -459484,13 +469728,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -459593,7 +469837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -459614,8 +469862,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -459624,8 +469872,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -459657,8 +469905,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
@@ -459709,8 +469957,8 @@
         {},
         {
             "techniqueID": "T1560.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {},
         {
@@ -459727,7 +469975,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1033",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
+        },
         {},
         {
             "techniqueID": "T1218.011",
@@ -459755,7 +470007,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 32,
+            "score": 33,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -459788,7 +470040,7 @@
         },
         {
             "techniqueID": "T1543",
-            "score": 9,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml"
         },
         {},
@@ -459810,7 +470062,7 @@
         {},
         {
             "techniqueID": "T1114",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
         },
         {
@@ -459857,7 +470109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1114.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {},
         {
             "techniqueID": "T1547",
@@ -459879,8 +470135,8 @@
         {},
         {
             "techniqueID": "T1087.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {},
         {},
@@ -459896,7 +470152,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {},
@@ -459904,13 +470164,17 @@
         {},
         {
             "techniqueID": "T1543.003",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {
             "techniqueID": "T1566.002",
@@ -460093,8 +470357,8 @@
         {},
         {
             "techniqueID": "T1218.003",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -460136,8 +470400,8 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
         {
@@ -460157,8 +470421,8 @@
         {},
         {
             "techniqueID": "T1112",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {},
         {
@@ -460168,7 +470432,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1491",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+        },
         {
             "techniqueID": "T1535",
             "score": 8,
@@ -460292,13 +470560,13 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 6,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 19,
+            "score": 20,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
@@ -460306,8 +470574,8 @@
         {},
         {
             "techniqueID": "T1482",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {},
         {},
@@ -460397,8 +470665,8 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
         {},
@@ -460490,7 +470758,11 @@
             "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
-        {},
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {},
         {},
         {
@@ -460740,13 +471012,13 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {},
         {},
@@ -460849,7 +471121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1021.001",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
         {},
         {
             "techniqueID": "T1484",
@@ -460870,8 +471146,8 @@
         {},
         {
             "techniqueID": "T1003.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {},
         {},
@@ -460880,8 +471156,8 @@
         {},
         {
             "techniqueID": "T1569.002",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1078.004",
@@ -460913,8 +471189,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/delete_shadowcopy_with_powershell.yml"
+            "score": 6,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/known_services_killed_by_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbadmin_delete_system_backups.yml"
         },
         {},
         {
diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv
index 642f5cf4d8..44ee4e8962 100644
--- a/docs/mitre-map/detections.csv
+++ b/docs/mitre-map/detections.csv
@@ -12110,1841 +12110,2208 @@ T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml,46
 T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
 T1086,No,-,55
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
-T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,48
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,47
+T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml,47
 T1060,No,-,45
 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml,44
 T1060,No,-,45
@@ -35598,373 +35965,373 @@ T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/dep
 T1204.001,No,-,28
 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,27
 T1204.001,No,-,28
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
-T1033,No,-,25
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
+T1033,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml,24
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml,23
 T1018,No,-,24
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml,23
@@ -36699,373 +37066,1107 @@ T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1018,No,-,24
 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml,23
 T1018,No,-,24
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
-T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,22
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml,20
+T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37087,7 +38188,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37109,7 +38211,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37131,7 +38234,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37153,7 +38257,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37175,7 +38280,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37197,7 +38303,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37219,7 +38326,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37241,7 +38349,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37263,7 +38372,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37285,7 +38395,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37307,7 +38418,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37329,7 +38441,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37351,7 +38464,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37373,7 +38487,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37395,7 +38510,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37417,7 +38533,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37439,7 +38556,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37461,7 +38579,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37483,7 +38602,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37505,7 +38625,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37527,7 +38648,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37549,7 +38671,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37571,7 +38694,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37593,7 +38717,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37615,7 +38740,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37637,7 +38763,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37659,7 +38786,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37681,7 +38809,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37703,7 +38832,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37725,7 +38855,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37747,7 +38878,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37769,7 +38901,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37791,7 +38924,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37813,7 +38947,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37835,7 +38970,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37857,7 +38993,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37879,7 +39016,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37901,7 +39039,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37923,7 +39062,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37945,7 +39085,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37967,7 +39108,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -37989,7 +39131,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38011,7 +39154,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38033,7 +39177,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38055,7 +39200,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38077,7 +39223,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38099,7 +39246,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38121,7 +39269,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38143,7 +39292,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38165,7 +39315,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38187,7 +39338,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38209,7 +39361,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38231,7 +39384,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38253,7 +39407,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38275,7 +39430,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38297,7 +39453,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38319,7 +39476,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38341,7 +39499,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38363,7 +39522,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38385,7 +39545,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38407,7 +39568,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38429,7 +39591,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38451,7 +39614,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38473,7 +39637,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38495,7 +39660,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38517,7 +39683,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38539,7 +39706,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38561,7 +39729,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38583,7 +39752,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38605,7 +39775,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38627,7 +39798,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38649,7 +39821,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38671,7 +39844,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38693,7 +39867,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38715,7 +39890,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38737,7 +39913,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38759,7 +39936,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38781,7 +39959,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38803,7 +39982,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38825,7 +40005,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38847,7 +40028,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38869,7 +40051,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38891,7 +40074,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38913,7 +40097,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38935,7 +40120,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38957,7 +40143,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -38979,7 +40166,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39001,7 +40189,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39023,7 +40212,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39045,7 +40235,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39067,7 +40258,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39089,7 +40281,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39111,7 +40304,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39133,7 +40327,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39155,7 +40350,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39177,7 +40373,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39199,7 +40396,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39221,7 +40419,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39243,7 +40442,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39265,7 +40465,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39287,7 +40488,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39309,7 +40511,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39331,7 +40534,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39353,7 +40557,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39375,7 +40580,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39397,7 +40603,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39419,7 +40626,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39441,7 +40649,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39463,7 +40672,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39485,7 +40695,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39507,7 +40718,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39529,7 +40741,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39551,7 +40764,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39573,7 +40787,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39595,7 +40810,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39617,7 +40833,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39639,7 +40856,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39661,7 +40879,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39683,7 +40902,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39705,7 +40925,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39727,7 +40948,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39749,7 +40971,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39771,7 +40994,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39793,7 +41017,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39815,7 +41040,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39837,7 +41063,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39859,7 +41086,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39881,7 +41109,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39903,7 +41132,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39925,7 +41155,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39947,7 +41178,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39969,7 +41201,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -39991,7 +41224,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40013,7 +41247,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40035,7 +41270,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40057,7 +41293,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40079,7 +41316,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40101,7 +41339,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40123,7 +41362,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40145,7 +41385,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40167,7 +41408,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40189,7 +41431,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40211,7 +41454,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40233,7 +41477,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40255,7 +41500,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40277,7 +41523,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40299,7 +41546,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40321,7 +41569,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40343,7 +41592,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40365,7 +41615,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40387,7 +41638,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40409,7 +41661,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40431,7 +41684,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40453,7 +41707,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40475,7 +41730,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40497,7 +41753,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40519,7 +41776,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40541,7 +41799,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40563,7 +41822,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40585,7 +41845,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40607,7 +41868,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40629,7 +41891,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40651,7 +41914,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40673,7 +41937,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40695,7 +41960,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40717,7 +41983,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40739,7 +42006,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40761,7 +42029,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40783,7 +42052,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40805,7 +42075,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40827,7 +42098,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40849,7 +42121,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40871,7 +42144,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40893,7 +42167,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40915,7 +42190,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40937,7 +42213,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40959,7 +42236,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -40981,7 +42259,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41003,7 +42282,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41025,7 +42305,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41047,7 +42328,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41069,7 +42351,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41091,7 +42374,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41113,7 +42397,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41135,7 +42420,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41157,7 +42443,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41179,7 +42466,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41201,7 +42489,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41223,7 +42512,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41245,7 +42535,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41267,7 +42558,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41289,7 +42581,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41311,7 +42604,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41333,7 +42627,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41355,7 +42650,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41377,7 +42673,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41399,7 +42696,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41421,7 +42719,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41443,7 +42742,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41465,7 +42765,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41487,7 +42788,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41509,7 +42811,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41531,7 +42834,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41553,7 +42857,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41575,7 +42880,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41597,7 +42903,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41619,7 +42926,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41641,7 +42949,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41663,7 +42972,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41685,7 +42995,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41707,7 +43018,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41729,7 +43041,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41751,7 +43064,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41773,7 +43087,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41795,7 +43110,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41817,7 +43133,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41839,7 +43156,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41861,7 +43179,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41883,7 +43202,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41905,7 +43225,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41927,7 +43248,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41949,7 +43271,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41971,7 +43294,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -41993,7 +43317,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42015,7 +43340,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42037,7 +43363,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42059,7 +43386,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42081,7 +43409,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42103,7 +43432,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42125,7 +43455,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42147,7 +43478,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42169,7 +43501,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42191,7 +43524,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42213,7 +43547,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42235,7 +43570,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42257,7 +43593,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42279,7 +43616,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42301,7 +43639,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42323,7 +43662,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42345,7 +43685,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42367,7 +43708,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42389,7 +43731,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42411,7 +43754,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42433,7 +43777,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42455,7 +43800,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42477,7 +43823,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42499,7 +43846,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42521,7 +43869,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42543,7 +43892,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42565,7 +43915,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42587,7 +43938,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42609,7 +43961,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42631,7 +43984,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42653,7 +44007,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42675,7 +44030,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42697,7 +44053,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42719,7 +44076,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42741,7 +44099,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42763,7 +44122,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42785,7 +44145,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42807,7 +44168,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42829,7 +44191,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42851,7 +44214,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42873,7 +44237,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42895,7 +44260,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42917,7 +44283,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42939,7 +44306,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42961,7 +44329,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -42983,7 +44352,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43005,7 +44375,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43027,7 +44398,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43049,7 +44421,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43071,7 +44444,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43093,7 +44467,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43115,7 +44490,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43137,7 +44513,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43159,7 +44536,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43181,7 +44559,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43203,7 +44582,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43225,7 +44605,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43247,7 +44628,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43269,7 +44651,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43291,7 +44674,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43313,7 +44697,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43335,7 +44720,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43357,7 +44743,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43379,7 +44766,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43401,7 +44789,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43423,7 +44812,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43445,7 +44835,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43467,7 +44858,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43489,7 +44881,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43511,7 +44904,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43533,7 +44927,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43555,7 +44950,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43577,7 +44973,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43599,7 +44996,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43621,7 +45019,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43643,7 +45042,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43665,7 +45065,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43687,7 +45088,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43709,7 +45111,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43731,7 +45134,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43753,7 +45157,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43775,7 +45180,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43797,7 +45203,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43819,7 +45226,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43841,7 +45249,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43863,7 +45272,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43885,7 +45295,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43907,7 +45318,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43929,7 +45341,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43951,7 +45364,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43973,7 +45387,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -43995,7 +45410,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44017,7 +45433,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44039,7 +45456,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44061,7 +45479,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44083,7 +45502,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44105,7 +45525,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44127,7 +45548,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44149,7 +45571,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44171,7 +45594,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44193,7 +45617,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44215,7 +45640,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44237,7 +45663,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44259,7 +45686,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44281,7 +45709,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44303,7 +45732,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44325,7 +45755,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44347,7 +45778,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44369,7 +45801,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44391,7 +45824,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44413,7 +45847,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44435,7 +45870,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44457,7 +45893,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44479,7 +45916,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44501,7 +45939,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44523,7 +45962,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44545,7 +45985,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44567,7 +46008,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44589,7 +46031,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44611,7 +46054,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44633,7 +46077,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44655,7 +46100,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44677,7 +46123,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44699,7 +46146,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44721,7 +46169,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44743,7 +46192,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44765,7 +46215,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44787,7 +46238,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44809,7 +46261,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44831,7 +46284,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44853,7 +46307,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44875,7 +46330,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44897,7 +46353,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44919,7 +46376,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44941,7 +46399,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44963,7 +46422,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -44985,7 +46445,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45007,7 +46468,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45029,7 +46491,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45051,7 +46514,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45073,7 +46537,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45095,7 +46560,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45117,7 +46583,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml,17
@@ -45139,7 +46606,8 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml,8
 T1076,No,-,22
-T1021.001,No,-,22
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml,20
+T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml,20
 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,16
 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,16
 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,16
@@ -48445,1472 +49913,1839 @@ T1553.002,No,-,19
 T1049,No,-,19
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1133,No,-,18
 T1074.001,No,-,18
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,16
-T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,16
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml,15
+T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml,15
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml,6
@@ -49922,10 +51757,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -49947,10 +51787,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -49972,10 +51817,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -49997,10 +51847,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50022,10 +51877,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50047,10 +51907,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50072,10 +51937,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50097,10 +51967,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50122,10 +51997,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50147,10 +52027,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50172,10 +52057,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50197,10 +52087,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50222,10 +52117,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50247,10 +52147,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50272,10 +52177,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50297,10 +52207,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50322,10 +52237,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50347,10 +52267,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50372,10 +52297,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50397,10 +52327,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50422,10 +52357,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50447,10 +52387,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50472,10 +52417,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50497,10 +52447,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50522,10 +52477,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50547,10 +52507,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50572,10 +52537,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50597,10 +52567,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50622,10 +52597,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50647,10 +52627,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50672,10 +52657,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50697,10 +52687,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50722,10 +52717,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50747,10 +52747,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50772,10 +52777,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50797,10 +52807,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50822,10 +52837,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50847,10 +52867,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50872,10 +52897,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50897,10 +52927,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50922,10 +52957,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50947,10 +52987,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50972,10 +53017,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -50997,10 +53047,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51022,10 +53077,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51047,10 +53107,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51072,10 +53137,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51097,10 +53167,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51122,10 +53197,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51147,10 +53227,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51172,10 +53257,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51197,10 +53287,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51222,10 +53317,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51247,10 +53347,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51272,10 +53377,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51297,10 +53407,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51322,10 +53437,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51347,10 +53467,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51372,10 +53497,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51397,10 +53527,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51422,10 +53557,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51447,10 +53587,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51472,10 +53617,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51497,10 +53647,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51522,10 +53677,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51547,10 +53707,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51572,10 +53737,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51597,10 +53767,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51622,10 +53797,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51647,10 +53827,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51672,10 +53857,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51697,10 +53887,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51722,10 +53917,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51747,10 +53947,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51772,10 +53977,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51797,10 +54007,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51822,10 +54037,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51847,10 +54067,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51872,10 +54097,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51897,10 +54127,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51922,10 +54157,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51947,10 +54187,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51972,10 +54217,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -51997,10 +54247,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52022,10 +54277,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52047,10 +54307,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52072,10 +54337,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52097,10 +54367,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52122,10 +54397,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52147,10 +54427,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52172,10 +54457,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52197,10 +54487,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52222,10 +54517,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52247,10 +54547,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52272,10 +54577,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52297,10 +54607,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52322,10 +54637,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52347,10 +54667,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52372,10 +54697,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52397,10 +54727,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52422,10 +54757,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52447,10 +54787,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52472,10 +54817,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52497,10 +54847,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52522,10 +54877,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52547,10 +54907,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52572,10 +54937,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52597,10 +54967,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52622,10 +54997,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52647,10 +55027,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52672,10 +55057,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52697,10 +55087,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52722,10 +55117,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52747,10 +55147,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52772,10 +55177,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52797,10 +55207,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52822,10 +55237,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52847,10 +55267,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52872,10 +55297,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52897,10 +55327,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52922,10 +55357,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52947,10 +55387,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52972,10 +55417,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -52997,10 +55447,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53022,10 +55477,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53047,10 +55507,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53072,10 +55537,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53097,10 +55567,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53122,10 +55597,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53147,10 +55627,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53172,10 +55657,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53197,10 +55687,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53222,10 +55717,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53247,10 +55747,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53272,10 +55777,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53297,10 +55807,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53322,10 +55837,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53347,10 +55867,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53372,10 +55897,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53397,10 +55927,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53422,10 +55957,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53447,10 +55987,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53472,10 +56017,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53497,10 +56047,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53522,10 +56077,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53547,10 +56107,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53572,10 +56137,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53597,10 +56167,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53622,10 +56197,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53647,10 +56227,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53672,10 +56257,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53697,10 +56287,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53722,10 +56317,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53747,10 +56347,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53772,10 +56377,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53797,10 +56407,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53822,10 +56437,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53847,10 +56467,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53872,10 +56497,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53897,10 +56527,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53922,10 +56557,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53947,10 +56587,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53972,10 +56617,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -53997,10 +56647,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54022,10 +56677,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54047,10 +56707,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54072,10 +56737,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54097,10 +56767,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54122,10 +56797,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54147,10 +56827,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54172,10 +56857,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54197,10 +56887,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54222,10 +56917,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54247,10 +56947,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54272,10 +56977,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54297,10 +57007,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54322,10 +57037,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54347,10 +57067,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54372,10 +57097,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54397,10 +57127,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54422,10 +57157,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54447,10 +57187,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54472,10 +57217,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54497,10 +57247,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54522,10 +57277,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54547,10 +57307,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54572,10 +57337,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54597,10 +57367,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54622,10 +57397,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54647,10 +57427,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54672,10 +57457,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54697,10 +57487,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54722,10 +57517,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54747,10 +57547,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54772,10 +57577,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54797,10 +57607,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54822,10 +57637,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54847,10 +57667,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54872,10 +57697,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54897,10 +57727,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54922,10 +57757,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54947,10 +57787,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54972,10 +57817,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -54997,10 +57847,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55022,10 +57877,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55047,10 +57907,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55072,10 +57937,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55097,10 +57967,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55122,10 +57997,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55147,10 +58027,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55172,10 +58057,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55197,10 +58087,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55222,10 +58117,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55247,10 +58147,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55272,10 +58177,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55297,10 +58207,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55322,10 +58237,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55347,10 +58267,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55372,10 +58297,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55397,10 +58327,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55422,10 +58357,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55447,10 +58387,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55472,10 +58417,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55497,10 +58447,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55522,10 +58477,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55547,10 +58507,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55572,10 +58537,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55597,10 +58567,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55622,10 +58597,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55647,10 +58627,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55672,10 +58657,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55697,10 +58687,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55722,10 +58717,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55747,10 +58747,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55772,10 +58777,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55797,10 +58807,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55822,10 +58837,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55847,10 +58867,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55872,10 +58897,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55897,10 +58927,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55922,10 +58957,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55947,10 +58987,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55972,10 +59017,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -55997,10 +59047,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56022,10 +59077,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56047,10 +59107,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56072,10 +59137,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56097,10 +59167,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56122,10 +59197,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56147,10 +59227,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56172,10 +59257,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56197,10 +59287,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56222,10 +59317,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56247,10 +59347,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56272,10 +59377,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56297,10 +59407,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56322,10 +59437,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56347,10 +59467,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56372,10 +59497,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56397,10 +59527,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56422,10 +59557,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56447,10 +59587,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56472,10 +59617,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56497,10 +59647,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56522,10 +59677,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56547,10 +59707,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56572,10 +59737,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56597,10 +59767,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56622,10 +59797,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56647,10 +59827,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56672,10 +59857,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56697,10 +59887,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56722,10 +59917,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56747,10 +59947,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56772,10 +59977,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56797,10 +60007,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56822,10 +60037,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56847,10 +60067,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56872,10 +60097,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56897,10 +60127,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56922,10 +60157,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56947,10 +60187,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56972,10 +60217,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -56997,10 +60247,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57022,10 +60277,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57047,10 +60307,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57072,10 +60337,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57097,10 +60367,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57122,10 +60397,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57147,10 +60427,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57172,10 +60457,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57197,10 +60487,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57222,10 +60517,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57247,10 +60547,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57272,10 +60577,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57297,10 +60607,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57322,10 +60637,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57347,10 +60667,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57372,10 +60697,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57397,10 +60727,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57422,10 +60757,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57447,10 +60787,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57472,10 +60817,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57497,10 +60847,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57522,10 +60877,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57547,10 +60907,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57572,10 +60937,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57597,10 +60967,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57622,10 +60997,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57647,10 +61027,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57672,10 +61057,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57697,10 +61087,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57722,10 +61117,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57747,10 +61147,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57772,10 +61177,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57797,10 +61207,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57822,10 +61237,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57847,10 +61267,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57872,10 +61297,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57897,10 +61327,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57922,10 +61357,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57947,10 +61387,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57972,10 +61417,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -57997,10 +61447,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58022,10 +61477,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58047,10 +61507,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58072,10 +61537,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58097,10 +61567,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58122,10 +61597,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58147,10 +61627,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58172,10 +61657,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58197,10 +61687,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58222,10 +61717,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58247,10 +61747,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58272,10 +61777,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58297,10 +61807,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58322,10 +61837,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58347,10 +61867,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58372,10 +61897,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58397,10 +61927,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58422,10 +61957,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58447,10 +61987,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58472,10 +62017,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58497,10 +62047,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58522,10 +62077,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58547,10 +62107,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58572,10 +62137,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58597,10 +62167,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58622,10 +62197,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58647,10 +62227,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58672,10 +62257,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58697,10 +62287,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58722,10 +62317,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58747,10 +62347,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58772,10 +62377,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58797,10 +62407,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58822,10 +62437,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58847,10 +62467,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58872,10 +62497,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58897,10 +62527,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58922,10 +62557,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58947,10 +62587,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58972,10 +62617,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -58997,10 +62647,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -59022,10 +62677,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -59047,10 +62707,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -59072,10 +62737,15 @@ T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,6
 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml,6
-T1087.001,No,-,17
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,14
-T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,14
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,12
+T1087.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,12
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml,13
+T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml,13
 T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml,13
@@ -59095,7 +62765,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59119,7 +62794,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59143,7 +62823,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59167,7 +62852,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59191,7 +62881,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59215,7 +62910,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59239,7 +62939,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59263,7 +62968,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59287,7 +62997,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59311,7 +63026,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59335,7 +63055,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59359,7 +63084,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59383,7 +63113,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59407,7 +63142,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59431,7 +63171,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59455,7 +63200,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59479,7 +63229,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59503,7 +63258,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59527,7 +63287,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59551,7 +63316,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59575,7 +63345,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59599,7 +63374,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59623,7 +63403,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59647,7 +63432,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59671,7 +63461,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59695,7 +63490,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59719,7 +63519,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59743,7 +63548,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59767,7 +63577,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59791,7 +63606,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59815,7 +63635,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59839,7 +63664,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59863,7 +63693,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59887,7 +63722,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59911,7 +63751,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59935,7 +63780,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59959,7 +63809,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -59983,7 +63838,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60007,7 +63867,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60031,7 +63896,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60055,7 +63925,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60079,7 +63954,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60103,7 +63983,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60127,7 +64012,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60151,7 +64041,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60175,7 +64070,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60199,7 +64099,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60223,7 +64128,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60247,7 +64157,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60271,7 +64186,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60295,7 +64215,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60319,7 +64244,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60343,7 +64273,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60367,7 +64302,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60391,7 +64331,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60415,7 +64360,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60439,7 +64389,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60463,7 +64418,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60487,7 +64447,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60511,7 +64476,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60535,7 +64505,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60559,7 +64534,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60583,7 +64563,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60607,7 +64592,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60631,7 +64621,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60655,7 +64650,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60679,7 +64679,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60703,7 +64708,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60727,7 +64737,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60751,7 +64766,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60775,7 +64795,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60799,7 +64824,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60823,7 +64853,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60847,7 +64882,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60871,7 +64911,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60895,7 +64940,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60919,7 +64969,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60943,7 +64998,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60967,7 +65027,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -60991,7 +65056,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61015,7 +65085,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61039,7 +65114,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61063,7 +65143,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61087,7 +65172,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61111,7 +65201,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61135,7 +65230,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61159,7 +65259,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61183,7 +65288,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61207,7 +65317,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61231,7 +65346,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61255,7 +65375,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61279,7 +65404,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61303,7 +65433,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61327,7 +65462,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61351,7 +65491,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61375,7 +65520,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61399,7 +65549,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61423,7 +65578,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61447,7 +65607,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61471,7 +65636,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61495,7 +65665,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61519,7 +65694,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61543,7 +65723,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61567,7 +65752,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61591,7 +65781,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61615,7 +65810,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61639,7 +65839,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61663,7 +65868,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61687,7 +65897,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61711,7 +65926,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61735,7 +65955,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61759,7 +65984,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61783,7 +66013,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61807,7 +66042,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61831,7 +66071,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61855,7 +66100,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61879,7 +66129,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61903,7 +66158,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61927,7 +66187,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61951,7 +66216,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61975,7 +66245,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -61999,7 +66274,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62023,7 +66303,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62047,7 +66332,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62071,7 +66361,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62095,7 +66390,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62119,7 +66419,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62143,7 +66448,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62167,7 +66477,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62191,7 +66506,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62215,7 +66535,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62239,7 +66564,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62263,7 +66593,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62287,7 +66622,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62311,7 +66651,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62335,7 +66680,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62359,7 +66709,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62383,7 +66738,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62407,7 +66767,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62431,7 +66796,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62455,7 +66825,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62479,7 +66854,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62503,7 +66883,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62527,7 +66912,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62551,7 +66941,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62575,7 +66970,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62599,7 +66999,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62623,7 +67028,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62647,7 +67057,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62671,7 +67086,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62695,7 +67115,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62719,7 +67144,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62743,7 +67173,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62767,7 +67202,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62791,7 +67231,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62815,7 +67260,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62839,7 +67289,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62863,7 +67318,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62887,7 +67347,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62911,7 +67376,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62935,7 +67405,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62959,7 +67434,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -62983,7 +67463,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63007,7 +67492,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63031,7 +67521,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63055,7 +67550,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63079,7 +67579,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63103,7 +67608,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63127,7 +67637,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63151,7 +67666,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63175,7 +67695,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63199,7 +67724,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63223,7 +67753,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63247,7 +67782,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63271,7 +67811,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63295,7 +67840,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63319,7 +67869,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63343,7 +67898,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63367,7 +67927,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63391,7 +67956,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63415,7 +67985,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63439,7 +68014,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63463,7 +68043,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63487,7 +68072,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63511,7 +68101,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63535,7 +68130,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63559,7 +68159,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63583,7 +68188,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63607,7 +68217,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63631,7 +68246,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63655,7 +68275,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63679,7 +68304,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63703,7 +68333,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63727,7 +68362,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63751,7 +68391,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63775,7 +68420,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63799,7 +68449,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63823,7 +68478,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63847,7 +68507,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63871,7 +68536,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63895,7 +68565,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63919,7 +68594,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63943,7 +68623,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63967,7 +68652,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -63991,7 +68681,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64015,7 +68710,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64039,7 +68739,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64063,7 +68768,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64087,7 +68797,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64111,7 +68826,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64135,7 +68855,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64159,7 +68884,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64183,7 +68913,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64207,7 +68942,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64231,7 +68971,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64255,7 +69000,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64279,7 +69029,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64303,7 +69058,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64327,7 +69087,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64351,7 +69116,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64375,7 +69145,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64399,7 +69174,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64423,7 +69203,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64447,7 +69232,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64471,7 +69261,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64495,7 +69290,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64519,7 +69319,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64543,7 +69348,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64567,7 +69377,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64591,7 +69406,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64615,7 +69435,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64639,7 +69464,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64663,7 +69493,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64687,7 +69522,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64711,7 +69551,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64735,7 +69580,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64759,7 +69609,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64783,7 +69638,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64807,7 +69667,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64831,7 +69696,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64855,7 +69725,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64879,7 +69754,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64903,7 +69783,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64927,7 +69812,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64951,7 +69841,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64975,7 +69870,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -64999,7 +69899,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65023,7 +69928,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65047,7 +69957,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65071,7 +69986,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65095,7 +70015,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65119,7 +70044,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65143,7 +70073,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65167,7 +70102,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65191,7 +70131,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65215,7 +70160,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65239,7 +70189,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65263,7 +70218,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65287,7 +70247,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65311,7 +70276,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65335,7 +70305,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65359,7 +70334,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65383,7 +70363,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65407,7 +70392,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65431,7 +70421,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65455,7 +70450,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65479,7 +70479,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65503,7 +70508,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65527,7 +70537,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65551,7 +70566,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65575,7 +70595,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65599,7 +70624,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65623,7 +70653,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65647,7 +70682,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65671,7 +70711,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65695,7 +70740,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65719,7 +70769,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65743,7 +70798,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65767,7 +70827,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65791,7 +70856,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65815,7 +70885,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65839,7 +70914,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65863,7 +70943,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65887,7 +70972,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65911,7 +71001,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65935,7 +71030,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65959,7 +71059,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -65983,7 +71088,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66007,7 +71117,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66031,7 +71146,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66055,7 +71175,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66079,7 +71204,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66103,7 +71233,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66127,7 +71262,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66151,7 +71291,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66175,7 +71320,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66199,7 +71349,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66223,7 +71378,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66247,7 +71407,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66271,7 +71436,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66295,7 +71465,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66319,7 +71494,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66343,7 +71523,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66367,7 +71552,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66391,7 +71581,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66415,7 +71610,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66439,7 +71639,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66463,7 +71668,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66487,7 +71697,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66511,7 +71726,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66535,7 +71755,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66559,7 +71784,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66583,7 +71813,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66607,7 +71842,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66631,7 +71871,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66655,7 +71900,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66679,7 +71929,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66703,7 +71958,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66727,7 +71987,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66751,7 +72016,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66775,7 +72045,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66799,7 +72074,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66823,7 +72103,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66847,7 +72132,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66871,7 +72161,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66895,7 +72190,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66919,7 +72219,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66943,7 +72248,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66967,7 +72277,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -66991,7 +72306,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67015,7 +72335,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67039,7 +72364,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67063,7 +72393,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67087,7 +72422,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67111,7 +72451,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67135,7 +72480,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67159,7 +72509,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67183,7 +72538,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67207,7 +72567,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67231,7 +72596,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67255,7 +72625,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67279,7 +72654,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67303,7 +72683,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67327,7 +72712,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67351,7 +72741,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67375,7 +72770,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67399,7 +72799,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67423,7 +72828,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67447,7 +72857,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67471,7 +72886,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67495,7 +72915,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67519,7 +72944,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67543,7 +72973,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67567,7 +73002,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67591,7 +73031,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67615,7 +73060,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67639,7 +73089,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67663,7 +73118,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67687,7 +73147,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67711,7 +73176,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67735,7 +73205,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67759,7 +73234,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67783,7 +73263,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67807,7 +73292,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67831,7 +73321,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67855,7 +73350,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -67879,7 +73379,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,15
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,10
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,10
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
@@ -81493,8 +86998,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81516,8 +87022,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81539,8 +87046,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81562,8 +87070,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81585,8 +87094,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81608,8 +87118,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81631,8 +87142,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81654,8 +87166,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81677,8 +87190,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81700,8 +87214,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81723,8 +87238,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81746,8 +87262,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81769,8 +87286,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81792,8 +87310,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81815,8 +87334,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81838,8 +87358,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81861,8 +87382,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81884,8 +87406,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81907,8 +87430,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81930,8 +87454,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81953,8 +87478,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81976,8 +87502,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -81999,8 +87526,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82022,8 +87550,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82045,8 +87574,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82068,8 +87598,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82091,8 +87622,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82114,8 +87646,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82137,8 +87670,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82160,8 +87694,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82183,8 +87718,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82206,8 +87742,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82229,8 +87766,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82252,8 +87790,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82275,8 +87814,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82298,8 +87838,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82321,8 +87862,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82344,8 +87886,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82367,8 +87910,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82390,8 +87934,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82413,8 +87958,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82436,8 +87982,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82459,8 +88006,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82482,8 +88030,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82505,8 +88054,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82528,8 +88078,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82551,8 +88102,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82574,8 +88126,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82597,8 +88150,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82620,8 +88174,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82643,8 +88198,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82666,8 +88222,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82689,8 +88246,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82712,8 +88270,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82735,8 +88294,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82758,8 +88318,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82781,8 +88342,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82804,8 +88366,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82827,8 +88390,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82850,8 +88414,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82873,8 +88438,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82896,8 +88462,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82919,8 +88486,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82942,8 +88510,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82965,8 +88534,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -82988,8 +88558,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83011,8 +88582,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83034,8 +88606,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83057,8 +88630,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83080,8 +88654,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83103,8 +88678,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83126,8 +88702,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83149,8 +88726,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83172,8 +88750,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83195,8 +88774,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83218,8 +88798,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83241,8 +88822,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83264,8 +88846,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83287,8 +88870,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83310,8 +88894,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83333,8 +88918,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83356,8 +88942,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83379,8 +88966,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83402,8 +88990,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83425,8 +89014,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83448,8 +89038,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83471,8 +89062,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83494,8 +89086,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83517,8 +89110,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83540,8 +89134,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83563,8 +89158,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83586,8 +89182,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83609,8 +89206,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83632,8 +89230,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83655,8 +89254,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83678,8 +89278,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83701,8 +89302,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83724,8 +89326,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83747,8 +89350,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83770,8 +89374,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83793,8 +89398,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83816,8 +89422,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83839,8 +89446,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83862,8 +89470,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83885,8 +89494,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83908,8 +89518,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83931,8 +89542,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83954,8 +89566,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -83977,8 +89590,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84000,8 +89614,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84023,8 +89638,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84046,8 +89662,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84069,8 +89686,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84092,8 +89710,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84115,8 +89734,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84138,8 +89758,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84161,8 +89782,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84184,8 +89806,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84207,8 +89830,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84230,8 +89854,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84253,8 +89878,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84276,8 +89902,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84299,8 +89926,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84322,8 +89950,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84345,8 +89974,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84368,8 +89998,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84391,8 +90022,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84414,8 +90046,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84437,8 +90070,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84460,8 +90094,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84483,8 +90118,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84506,8 +90142,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84529,8 +90166,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84552,8 +90190,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84575,8 +90214,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84598,8 +90238,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84621,8 +90262,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84644,8 +90286,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84667,8 +90310,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84690,8 +90334,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84713,8 +90358,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84736,8 +90382,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84759,8 +90406,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84782,8 +90430,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84805,8 +90454,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84828,8 +90478,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84851,8 +90502,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84874,8 +90526,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84897,8 +90550,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84920,8 +90574,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84943,8 +90598,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84966,8 +90622,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -84989,8 +90646,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85012,8 +90670,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85035,8 +90694,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85058,8 +90718,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85081,8 +90742,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85104,8 +90766,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85127,8 +90790,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85150,8 +90814,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85173,8 +90838,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85196,8 +90862,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85219,8 +90886,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85242,8 +90910,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85265,8 +90934,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85288,8 +90958,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85311,8 +90982,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85334,8 +91006,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85357,8 +91030,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85380,8 +91054,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85403,8 +91078,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85426,8 +91102,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85449,8 +91126,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85472,8 +91150,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85495,8 +91174,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85518,8 +91198,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85541,8 +91222,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85564,8 +91246,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85587,8 +91270,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85610,8 +91294,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85633,8 +91318,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85656,8 +91342,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85679,8 +91366,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85702,8 +91390,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85725,8 +91414,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85748,8 +91438,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85771,8 +91462,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85794,8 +91486,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85817,8 +91510,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85840,8 +91534,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85863,8 +91558,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85886,8 +91582,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85909,8 +91606,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85932,8 +91630,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85955,8 +91654,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -85978,8 +91678,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86001,8 +91702,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86024,8 +91726,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86047,8 +91750,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86070,8 +91774,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86093,8 +91798,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86116,8 +91822,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86139,8 +91846,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86162,8 +91870,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86185,8 +91894,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86208,8 +91918,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86231,8 +91942,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86254,8 +91966,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86277,8 +91990,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86300,8 +92014,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86323,8 +92038,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86346,8 +92062,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86369,8 +92086,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86392,8 +92110,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86415,8 +92134,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86438,8 +92158,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86461,8 +92182,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86484,8 +92206,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86507,8 +92230,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86530,8 +92254,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86553,8 +92278,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86576,8 +92302,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86599,8 +92326,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86622,8 +92350,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86645,8 +92374,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86668,8 +92398,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86691,8 +92422,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86714,8 +92446,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86737,8 +92470,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86760,8 +92494,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86783,8 +92518,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86806,8 +92542,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86829,8 +92566,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86852,8 +92590,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86875,8 +92614,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86898,8 +92638,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86921,8 +92662,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86944,8 +92686,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86967,8 +92710,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -86990,8 +92734,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87013,8 +92758,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87036,8 +92782,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87059,8 +92806,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87082,8 +92830,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87105,8 +92854,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87128,8 +92878,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87151,8 +92902,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87174,8 +92926,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87197,8 +92950,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87220,8 +92974,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87243,8 +92998,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87266,8 +93022,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87289,8 +93046,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87312,8 +93070,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87335,8 +93094,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87358,8 +93118,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87381,8 +93142,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87404,8 +93166,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87427,8 +93190,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87450,8 +93214,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87473,8 +93238,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87496,8 +93262,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87519,8 +93286,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87542,8 +93310,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87565,8 +93334,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87588,8 +93358,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87611,8 +93382,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87634,8 +93406,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87657,8 +93430,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87680,8 +93454,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87703,8 +93478,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87726,8 +93502,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87749,8 +93526,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87772,8 +93550,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87795,8 +93574,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87818,8 +93598,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87841,8 +93622,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87864,8 +93646,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87887,8 +93670,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87910,8 +93694,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87933,8 +93718,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87956,8 +93742,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -87979,8 +93766,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88002,8 +93790,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88025,8 +93814,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88048,8 +93838,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88071,8 +93862,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88094,8 +93886,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88117,8 +93910,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88140,8 +93934,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88163,8 +93958,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88186,8 +93982,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88209,8 +94006,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88232,8 +94030,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88255,8 +94054,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88278,8 +94078,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88301,8 +94102,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88324,8 +94126,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88347,8 +94150,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88370,8 +94174,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88393,8 +94198,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88416,8 +94222,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88439,8 +94246,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88462,8 +94270,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88485,8 +94294,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88508,8 +94318,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88531,8 +94342,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88554,8 +94366,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88577,8 +94390,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88600,8 +94414,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88623,8 +94438,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88646,8 +94462,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88669,8 +94486,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88692,8 +94510,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88715,8 +94534,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88738,8 +94558,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88761,8 +94582,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88784,8 +94606,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88807,8 +94630,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88830,8 +94654,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88853,8 +94678,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88876,8 +94702,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88899,8 +94726,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88922,8 +94750,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88945,8 +94774,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88968,8 +94798,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -88991,8 +94822,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89014,8 +94846,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89037,8 +94870,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89060,8 +94894,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89083,8 +94918,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89106,8 +94942,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89129,8 +94966,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89152,8 +94990,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89175,8 +95014,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89198,8 +95038,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89221,8 +95062,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89244,8 +95086,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89267,8 +95110,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89290,8 +95134,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89313,8 +95158,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89336,8 +95182,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89359,8 +95206,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89382,8 +95230,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89405,8 +95254,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89428,8 +95278,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89451,8 +95302,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89474,8 +95326,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89497,8 +95350,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89520,8 +95374,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89543,8 +95398,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89566,8 +95422,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89589,8 +95446,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89612,8 +95470,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89635,8 +95494,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89658,8 +95518,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89681,8 +95542,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89704,8 +95566,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89727,8 +95590,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89750,8 +95614,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89773,8 +95638,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89796,8 +95662,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89819,8 +95686,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89842,8 +95710,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89865,8 +95734,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89888,8 +95758,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1573.001,No,-,11
 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
@@ -89911,8 +95782,9 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml,2
 T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml,2
 T1059.006,No,-,11
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,9
-T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,9
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml,8
+T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml,8
 T1035,No,-,11
 T1143,No,-,10
 T1132.001,No,-,10
@@ -104975,12 +110847,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105002,12 +110875,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105029,12 +110903,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105056,12 +110931,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105083,12 +110959,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105110,12 +110987,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105137,12 +111015,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105164,12 +111043,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105191,12 +111071,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105218,12 +111099,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105245,12 +111127,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105272,12 +111155,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105299,12 +111183,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105326,12 +111211,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105353,12 +111239,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105380,12 +111267,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105407,12 +111295,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105434,12 +111323,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105461,12 +111351,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105488,12 +111379,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105515,12 +111407,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105542,12 +111435,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105569,12 +111463,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105596,12 +111491,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105623,12 +111519,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105650,12 +111547,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105677,12 +111575,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105704,12 +111603,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105731,12 +111631,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105758,12 +111659,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105785,12 +111687,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105812,12 +111715,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105839,12 +111743,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105866,12 +111771,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105893,12 +111799,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105920,12 +111827,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105947,12 +111855,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -105974,12 +111883,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106001,12 +111911,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106028,12 +111939,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106055,12 +111967,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106082,12 +111995,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106109,12 +112023,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106136,12 +112051,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106163,12 +112079,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106190,12 +112107,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106217,12 +112135,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106244,12 +112163,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106271,12 +112191,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106298,12 +112219,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106325,12 +112247,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106352,12 +112275,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106379,12 +112303,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106406,12 +112331,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106433,12 +112359,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106460,12 +112387,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106487,12 +112415,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106514,12 +112443,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106541,12 +112471,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106568,12 +112499,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106595,12 +112527,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106622,12 +112555,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106649,12 +112583,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106676,12 +112611,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106703,12 +112639,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106730,12 +112667,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106757,12 +112695,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106784,12 +112723,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106811,12 +112751,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106838,12 +112779,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106865,12 +112807,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106892,12 +112835,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106919,12 +112863,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106946,12 +112891,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -106973,12 +112919,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107000,12 +112947,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107027,12 +112975,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107054,12 +113003,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107081,12 +113031,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107108,12 +113059,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107135,12 +113087,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107162,12 +113115,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107189,12 +113143,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107216,12 +113171,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107243,12 +113199,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107270,12 +113227,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107297,12 +113255,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107324,12 +113283,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107351,12 +113311,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107378,12 +113339,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107405,12 +113367,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107432,12 +113395,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107459,12 +113423,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107486,12 +113451,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107513,12 +113479,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107540,12 +113507,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107567,12 +113535,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107594,12 +113563,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107621,12 +113591,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107648,12 +113619,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107675,12 +113647,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107702,12 +113675,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107729,12 +113703,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107756,12 +113731,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107783,12 +113759,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107810,12 +113787,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107837,12 +113815,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107864,12 +113843,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107891,12 +113871,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107918,12 +113899,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107945,12 +113927,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107972,12 +113955,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -107999,12 +113983,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108026,12 +114011,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108053,12 +114039,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108080,12 +114067,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108107,12 +114095,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108134,12 +114123,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108161,12 +114151,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108188,12 +114179,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108215,12 +114207,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108242,12 +114235,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108269,12 +114263,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108296,12 +114291,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108323,12 +114319,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108350,12 +114347,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108377,12 +114375,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108404,12 +114403,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108431,12 +114431,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108458,12 +114459,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108485,12 +114487,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108512,12 +114515,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108539,12 +114543,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108566,12 +114571,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108593,12 +114599,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108620,12 +114627,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108647,12 +114655,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108674,12 +114683,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108701,12 +114711,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108728,12 +114739,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108755,12 +114767,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108782,12 +114795,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108809,12 +114823,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108836,12 +114851,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108863,12 +114879,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108890,12 +114907,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108917,12 +114935,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108944,12 +114963,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108971,12 +114991,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -108998,12 +115019,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109025,12 +115047,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109052,12 +115075,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109079,12 +115103,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109106,12 +115131,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109133,12 +115159,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109160,12 +115187,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109187,12 +115215,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109214,12 +115243,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109241,12 +115271,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109268,12 +115299,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109295,12 +115327,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109322,12 +115355,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109349,12 +115383,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109376,12 +115411,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109403,12 +115439,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109430,12 +115467,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109457,12 +115495,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109484,12 +115523,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109511,12 +115551,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109538,12 +115579,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109565,12 +115607,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109592,12 +115635,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109619,12 +115663,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109646,12 +115691,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109673,12 +115719,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109700,12 +115747,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109727,12 +115775,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109754,12 +115803,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109781,12 +115831,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109808,12 +115859,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109835,12 +115887,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109862,12 +115915,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109889,12 +115943,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109916,12 +115971,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109943,12 +115999,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109970,12 +116027,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -109997,12 +116055,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110024,12 +116083,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110051,12 +116111,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110078,12 +116139,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110105,12 +116167,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110132,12 +116195,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110159,12 +116223,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110186,12 +116251,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110213,12 +116279,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110240,12 +116307,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110267,12 +116335,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110294,12 +116363,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110321,12 +116391,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110348,12 +116419,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110375,12 +116447,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110402,12 +116475,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110429,12 +116503,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110456,12 +116531,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110483,12 +116559,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110510,12 +116587,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110537,12 +116615,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110564,12 +116643,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110591,12 +116671,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110618,12 +116699,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110645,12 +116727,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110672,12 +116755,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110699,12 +116783,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110726,12 +116811,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110753,12 +116839,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110780,12 +116867,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110807,12 +116895,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110834,12 +116923,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110861,12 +116951,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110888,12 +116979,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110915,12 +117007,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110942,12 +117035,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110969,12 +117063,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -110996,12 +117091,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111023,12 +117119,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111050,12 +117147,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111077,12 +117175,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111104,12 +117203,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111131,12 +117231,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111158,12 +117259,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111185,12 +117287,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111212,12 +117315,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111239,12 +117343,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111266,12 +117371,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111293,12 +117399,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111320,12 +117427,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111347,12 +117455,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111374,12 +117483,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111401,12 +117511,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111428,12 +117539,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111455,12 +117567,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111482,12 +117595,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111509,12 +117623,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111536,12 +117651,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111563,12 +117679,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111590,12 +117707,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111617,12 +117735,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111644,12 +117763,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111671,12 +117791,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111698,12 +117819,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111725,12 +117847,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111752,12 +117875,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111779,12 +117903,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111806,12 +117931,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111833,12 +117959,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111860,12 +117987,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111887,12 +118015,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111914,12 +118043,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111941,12 +118071,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111968,12 +118099,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -111995,12 +118127,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112022,12 +118155,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112049,12 +118183,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112076,12 +118211,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112103,12 +118239,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112130,12 +118267,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112157,12 +118295,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112184,12 +118323,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112211,12 +118351,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112238,12 +118379,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112265,12 +118407,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112292,12 +118435,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112319,12 +118463,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112346,12 +118491,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112373,12 +118519,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112400,12 +118547,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112427,12 +118575,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112454,12 +118603,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112481,12 +118631,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112508,12 +118659,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112535,12 +118687,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112562,12 +118715,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112589,12 +118743,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112616,12 +118771,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112643,12 +118799,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112670,12 +118827,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112697,12 +118855,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112724,12 +118883,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112751,12 +118911,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112778,12 +118939,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112805,12 +118967,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112832,12 +118995,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112859,12 +119023,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112886,12 +119051,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112913,12 +119079,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112940,12 +119107,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112967,12 +119135,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -112994,12 +119163,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113021,12 +119191,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113048,12 +119219,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113075,12 +119247,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113102,12 +119275,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113129,12 +119303,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113156,12 +119331,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113183,12 +119359,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113210,12 +119387,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113237,12 +119415,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113264,12 +119443,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113291,12 +119471,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113318,12 +119499,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113345,12 +119527,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113372,12 +119555,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113399,12 +119583,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113426,12 +119611,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113453,12 +119639,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113480,12 +119667,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113507,12 +119695,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113534,12 +119723,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113561,12 +119751,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113588,12 +119779,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113615,12 +119807,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113642,12 +119835,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113669,12 +119863,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113696,12 +119891,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113723,12 +119919,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113750,12 +119947,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113777,12 +119975,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113804,12 +120003,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113831,12 +120031,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113858,12 +120059,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113885,12 +120087,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113912,12 +120115,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113939,12 +120143,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113966,12 +120171,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -113993,12 +120199,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114020,12 +120227,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114047,12 +120255,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114074,12 +120283,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114101,12 +120311,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114128,12 +120339,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114155,12 +120367,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114182,12 +120395,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114209,12 +120423,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114236,12 +120451,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114263,12 +120479,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114290,12 +120507,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114317,12 +120535,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114344,12 +120563,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114371,12 +120591,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114398,12 +120619,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114425,12 +120647,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114452,12 +120675,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114479,12 +120703,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114506,12 +120731,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114533,12 +120759,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114560,12 +120787,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114587,12 +120815,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114614,12 +120843,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114641,12 +120871,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114668,12 +120899,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114695,12 +120927,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114722,12 +120955,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114749,12 +120983,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114776,12 +121011,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114803,12 +121039,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114830,12 +121067,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -114857,12 +121095,13 @@ T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1552.001,No,-,8
 T1027.005,No,-,8
 T1065,No,-,8
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,2
-T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml,1
+T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml,1
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml,2
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml,2
@@ -143497,7 +149736,11 @@ T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1055.001,No,-,6
 T1090.001,No,-,6
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143506,7 +149749,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143525,7 +149772,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143534,7 +149785,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143553,7 +149808,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143562,7 +149821,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143581,7 +149844,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143590,7 +149857,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143609,7 +149880,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143618,7 +149893,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143637,7 +149916,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143646,7 +149929,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143665,7 +149952,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143674,7 +149965,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143693,7 +149988,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143702,7 +150001,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143721,7 +150024,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143730,7 +150037,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143749,7 +150060,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143758,7 +150073,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143777,7 +150096,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143786,7 +150109,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143805,7 +150132,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143814,7 +150145,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143833,7 +150168,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143842,7 +150181,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143861,7 +150204,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143870,7 +150217,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143889,7 +150240,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143898,7 +150253,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143917,7 +150276,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143926,7 +150289,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143945,7 +150312,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143954,7 +150325,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -143973,7 +150348,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -143982,7 +150361,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144001,7 +150384,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144010,7 +150397,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144029,7 +150420,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144038,7 +150433,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144057,7 +150456,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144066,7 +150469,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144085,7 +150492,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144094,7 +150505,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144113,7 +150528,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144122,7 +150541,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144141,7 +150564,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144150,7 +150577,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144169,7 +150600,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144178,7 +150613,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144197,7 +150636,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144206,7 +150649,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144225,7 +150672,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144234,7 +150685,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144253,7 +150708,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144262,7 +150721,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144281,7 +150744,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144290,7 +150757,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144309,7 +150780,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144318,7 +150793,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144337,7 +150816,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144346,7 +150829,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144365,7 +150852,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144374,7 +150865,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144393,7 +150888,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144402,7 +150901,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144421,7 +150924,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144430,7 +150937,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144449,7 +150960,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144458,7 +150973,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144477,7 +150996,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144486,7 +151009,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144505,7 +151032,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144514,7 +151045,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144533,7 +151068,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144542,7 +151081,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144561,7 +151104,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144570,7 +151117,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144589,7 +151140,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144598,7 +151153,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144617,7 +151176,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144626,7 +151189,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144645,7 +151212,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144654,7 +151225,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144673,7 +151248,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144682,7 +151261,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144701,7 +151284,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144710,7 +151297,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144729,7 +151320,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144738,7 +151333,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144757,7 +151356,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144766,7 +151369,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144785,7 +151392,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144794,7 +151405,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144813,7 +151428,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144822,7 +151441,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144841,7 +151464,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144850,7 +151477,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144869,7 +151500,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144878,7 +151513,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144897,7 +151536,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144906,7 +151549,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144925,7 +151572,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144934,7 +151585,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144953,7 +151608,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144962,7 +151621,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -144981,7 +151644,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -144990,7 +151657,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145009,7 +151680,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145018,7 +151693,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145037,7 +151716,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145046,7 +151729,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145065,7 +151752,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145074,7 +151765,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145093,7 +151788,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145102,7 +151801,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145121,7 +151824,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145130,7 +151837,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145149,7 +151860,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145158,7 +151873,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145177,7 +151896,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145186,7 +151909,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145205,7 +151932,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145214,7 +151945,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145233,7 +151968,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145242,7 +151981,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145261,7 +152004,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145270,7 +152017,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145289,7 +152040,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145298,7 +152053,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145317,7 +152076,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145326,7 +152089,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145345,7 +152112,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145354,7 +152125,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145373,7 +152148,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145382,7 +152161,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145401,7 +152184,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145410,7 +152197,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145429,7 +152220,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145438,7 +152233,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145457,7 +152256,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145466,7 +152269,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145485,7 +152292,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145494,7 +152305,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145513,7 +152328,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145522,7 +152341,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145541,7 +152364,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145550,7 +152377,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145569,7 +152400,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145578,7 +152413,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145597,7 +152436,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145606,7 +152449,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145625,7 +152472,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145634,7 +152485,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145653,7 +152508,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145662,7 +152521,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145681,7 +152544,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145690,7 +152557,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145709,7 +152580,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145718,7 +152593,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145737,7 +152616,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145746,7 +152629,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145765,7 +152652,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145774,7 +152665,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145793,7 +152688,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145802,7 +152701,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145821,7 +152724,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145830,7 +152737,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145849,7 +152760,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145858,7 +152773,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145877,7 +152796,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145886,7 +152809,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145905,7 +152832,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145914,7 +152845,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145933,7 +152868,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145942,7 +152881,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145961,7 +152904,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145970,7 +152917,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -145989,7 +152940,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -145998,7 +152953,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146017,7 +152976,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146026,7 +152989,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146045,7 +153012,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146054,7 +153025,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146073,7 +153048,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146082,7 +153061,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146101,7 +153084,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146110,7 +153097,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146129,7 +153120,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146138,7 +153133,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146157,7 +153156,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146166,7 +153169,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146185,7 +153192,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146194,7 +153205,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146213,7 +153228,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146222,7 +153241,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146241,7 +153264,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146250,7 +153277,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146269,7 +153300,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146278,7 +153313,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146297,7 +153336,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146306,7 +153349,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146325,7 +153372,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146334,7 +153385,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146353,7 +153408,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146362,7 +153421,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146381,7 +153444,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146390,7 +153457,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146409,7 +153480,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146418,7 +153493,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146437,7 +153516,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146446,7 +153529,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146465,7 +153552,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146474,7 +153565,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146493,7 +153588,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146502,7 +153601,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146521,7 +153624,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146530,7 +153637,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146549,7 +153660,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146558,7 +153673,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146577,7 +153696,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146586,7 +153709,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146605,7 +153732,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146614,7 +153745,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146633,7 +153768,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146642,7 +153781,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146661,7 +153804,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146670,7 +153817,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146689,7 +153840,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146698,7 +153853,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146717,7 +153876,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146726,7 +153889,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146745,7 +153912,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146754,7 +153925,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146773,7 +153948,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146782,7 +153961,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146801,7 +153984,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146810,7 +153997,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146829,7 +154020,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146838,7 +154033,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146857,7 +154056,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146866,7 +154069,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146885,7 +154092,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146894,7 +154105,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146913,7 +154128,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146922,7 +154141,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146941,7 +154164,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146950,7 +154177,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146969,7 +154200,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -146978,7 +154213,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -146997,7 +154236,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147006,7 +154249,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147025,7 +154272,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147034,7 +154285,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147053,7 +154308,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147062,7 +154321,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147081,7 +154344,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147090,7 +154357,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147109,7 +154380,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147118,7 +154393,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147137,7 +154416,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147146,7 +154429,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147165,7 +154452,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147174,7 +154465,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147193,7 +154488,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147202,7 +154501,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147221,7 +154524,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147230,7 +154537,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147249,7 +154560,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147258,7 +154573,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147277,7 +154596,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147286,7 +154609,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147305,7 +154632,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147314,7 +154645,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147333,7 +154668,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147342,7 +154681,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147361,7 +154704,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147370,7 +154717,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147389,7 +154740,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147398,7 +154753,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147417,7 +154776,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147426,7 +154789,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147445,7 +154812,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147454,7 +154825,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147473,7 +154848,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147482,7 +154861,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147501,7 +154884,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147510,7 +154897,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147529,7 +154920,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147538,7 +154933,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147557,7 +154956,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147566,7 +154969,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147585,7 +154992,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147594,7 +155005,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147613,7 +155028,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147622,7 +155041,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147641,7 +155064,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147650,7 +155077,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147669,7 +155100,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147678,7 +155113,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147697,7 +155136,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147706,7 +155149,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147725,7 +155172,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147734,7 +155185,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147753,7 +155208,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147762,7 +155221,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147781,7 +155244,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147790,7 +155257,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147809,7 +155280,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147818,7 +155293,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147837,7 +155316,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147846,7 +155329,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147865,7 +155352,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147874,7 +155365,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147893,7 +155388,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147902,7 +155401,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147921,7 +155424,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147930,7 +155437,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147949,7 +155460,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147958,7 +155473,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -147977,7 +155496,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -147986,7 +155509,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148005,7 +155532,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148014,7 +155545,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148033,7 +155568,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148042,7 +155581,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148061,7 +155604,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148070,7 +155617,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148089,7 +155640,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148098,7 +155653,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148117,7 +155676,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148126,7 +155689,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148145,7 +155712,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148154,7 +155725,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148173,7 +155748,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148182,7 +155761,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148201,7 +155784,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148210,7 +155797,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148229,7 +155820,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148238,7 +155833,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148257,7 +155856,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148266,7 +155869,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148285,7 +155892,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148294,7 +155905,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148313,7 +155928,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148322,7 +155941,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148341,7 +155964,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148350,7 +155977,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148369,7 +156000,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148378,7 +156013,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148397,7 +156036,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148406,7 +156049,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148425,7 +156072,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148434,7 +156085,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148453,7 +156108,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148462,7 +156121,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148481,7 +156144,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148490,7 +156157,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148509,7 +156180,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148518,7 +156193,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148537,7 +156216,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148546,7 +156229,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148565,7 +156252,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148574,7 +156265,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148593,7 +156288,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148602,7 +156301,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148621,7 +156324,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148630,7 +156337,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148649,7 +156360,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148658,7 +156373,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148677,7 +156396,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148686,7 +156409,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148705,7 +156432,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148714,7 +156445,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148733,7 +156468,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148742,7 +156481,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148761,7 +156504,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148770,7 +156517,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148789,7 +156540,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148798,7 +156553,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148817,7 +156576,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148826,7 +156589,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148845,7 +156612,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148854,7 +156625,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148873,7 +156648,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148882,7 +156661,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148901,7 +156684,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148910,7 +156697,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148929,7 +156720,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148938,7 +156733,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148957,7 +156756,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148966,7 +156769,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -148985,7 +156792,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -148994,7 +156805,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149013,7 +156828,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149022,7 +156841,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149041,7 +156864,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149050,7 +156877,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149069,7 +156900,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149078,7 +156913,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149097,7 +156936,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149106,7 +156949,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149125,7 +156972,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149134,7 +156985,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149153,7 +157008,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149162,7 +157021,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149181,7 +157044,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149190,7 +157057,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149209,7 +157080,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149218,7 +157093,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149237,7 +157116,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149246,7 +157129,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149265,7 +157152,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149274,7 +157165,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149293,7 +157188,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149302,7 +157201,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149321,7 +157224,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149330,7 +157237,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149349,7 +157260,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149358,7 +157273,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149377,7 +157296,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149386,7 +157309,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149405,7 +157332,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149414,7 +157345,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149433,7 +157368,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149442,7 +157381,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149461,7 +157404,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149470,7 +157417,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149489,7 +157440,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149498,7 +157453,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149517,7 +157476,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149526,7 +157489,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149545,7 +157512,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149554,7 +157525,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149573,7 +157548,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149582,7 +157561,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149601,7 +157584,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149610,7 +157597,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149629,7 +157620,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149638,7 +157633,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149657,7 +157656,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149666,7 +157669,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149685,7 +157692,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149694,7 +157705,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149713,7 +157728,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149722,7 +157741,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149741,7 +157764,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149750,7 +157777,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149769,7 +157800,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149778,7 +157813,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149797,7 +157836,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149806,7 +157849,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149825,7 +157872,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149834,7 +157885,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149853,7 +157908,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149862,7 +157921,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149881,7 +157944,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149890,7 +157957,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149909,7 +157980,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149918,7 +157993,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149937,7 +158016,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149946,7 +158029,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149965,7 +158052,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -149974,7 +158065,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -149993,7 +158088,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150002,7 +158101,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150021,7 +158124,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150030,7 +158137,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150049,7 +158160,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150058,7 +158173,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150077,7 +158196,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150086,7 +158209,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150105,7 +158232,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150114,7 +158245,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150133,7 +158268,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150142,7 +158281,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150161,7 +158304,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150170,7 +158317,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150189,7 +158340,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150198,7 +158353,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150217,7 +158376,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150226,7 +158389,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150245,7 +158412,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150254,7 +158425,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150273,7 +158448,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150282,7 +158461,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150301,7 +158484,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150310,7 +158497,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150329,7 +158520,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150338,7 +158533,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150357,7 +158556,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150366,7 +158569,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150385,7 +158592,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150394,7 +158605,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150413,7 +158628,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150422,7 +158641,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150441,7 +158664,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150450,7 +158677,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150469,7 +158700,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150478,7 +158713,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150497,7 +158736,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150506,7 +158749,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150525,7 +158772,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150534,7 +158785,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150553,7 +158808,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150562,7 +158821,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150581,7 +158844,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150590,7 +158857,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150609,7 +158880,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150618,7 +158893,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150637,7 +158916,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150646,7 +158929,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150665,7 +158952,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150674,7 +158965,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150693,7 +158988,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150702,7 +159001,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150721,7 +159024,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150730,7 +159037,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150749,7 +159060,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150758,7 +159073,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150777,7 +159096,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150786,7 +159109,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150805,7 +159132,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150814,7 +159145,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150833,7 +159168,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150842,7 +159181,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150861,7 +159204,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150870,7 +159217,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150889,7 +159240,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150898,7 +159253,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150917,7 +159276,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150926,7 +159289,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150945,7 +159312,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150954,7 +159325,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -150973,7 +159348,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -150982,7 +159361,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151001,7 +159384,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151010,7 +159397,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151029,7 +159420,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151038,7 +159433,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151057,7 +159456,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151066,7 +159469,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151085,7 +159492,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151094,7 +159505,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151113,7 +159528,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151122,7 +159541,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151141,7 +159564,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151150,7 +159577,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151169,7 +159600,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151178,7 +159613,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151197,7 +159636,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151206,7 +159649,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151225,7 +159672,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151234,7 +159685,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151253,7 +159708,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151262,7 +159721,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151281,7 +159744,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151290,7 +159757,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151309,7 +159780,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151318,7 +159793,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151337,7 +159816,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151346,7 +159829,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151365,7 +159852,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151374,7 +159865,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151393,7 +159888,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151402,7 +159901,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151421,7 +159924,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151430,7 +159937,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151449,7 +159960,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151458,7 +159973,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151477,7 +159996,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151486,7 +160009,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151505,7 +160032,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151514,7 +160045,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151533,7 +160068,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151542,7 +160081,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151561,7 +160104,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151570,7 +160117,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151589,7 +160140,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151598,7 +160153,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151617,7 +160176,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151626,7 +160189,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151645,7 +160212,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151654,7 +160225,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151673,7 +160248,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151682,7 +160261,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151701,7 +160284,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151710,7 +160297,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151729,7 +160320,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151738,7 +160333,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151757,7 +160356,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151766,7 +160369,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151785,7 +160392,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151794,7 +160405,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151813,7 +160428,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151822,7 +160441,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151841,7 +160464,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151850,7 +160477,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151869,7 +160500,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151878,7 +160513,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151897,7 +160536,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151906,7 +160549,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151925,7 +160572,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151934,7 +160585,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151953,7 +160608,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151962,7 +160621,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -151981,7 +160644,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -151990,7 +160657,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152009,7 +160680,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152018,7 +160693,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152037,7 +160716,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152046,7 +160729,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152065,7 +160752,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152074,7 +160765,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152093,7 +160788,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152102,7 +160801,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152121,7 +160824,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152130,7 +160837,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152149,7 +160860,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152158,7 +160873,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152177,7 +160896,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152186,7 +160909,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152205,7 +160932,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152214,7 +160945,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152233,7 +160968,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152242,7 +160981,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152261,7 +161004,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152270,7 +161017,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152289,7 +161040,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152298,7 +161053,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152317,7 +161076,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152326,7 +161089,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152345,7 +161112,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152354,7 +161125,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152373,7 +161148,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152382,7 +161161,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152401,7 +161184,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152410,7 +161197,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152429,7 +161220,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152438,7 +161233,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152457,7 +161256,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152466,7 +161269,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152485,7 +161292,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152494,7 +161305,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152513,7 +161328,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152522,7 +161341,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152541,7 +161364,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152550,7 +161377,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152569,7 +161400,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152578,7 +161413,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152597,7 +161436,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152606,7 +161449,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152625,7 +161472,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152634,7 +161485,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152653,7 +161508,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152662,7 +161521,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152681,7 +161544,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152690,7 +161557,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152709,7 +161580,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152718,7 +161593,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152737,7 +161616,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152746,7 +161629,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152765,7 +161652,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152774,7 +161665,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152793,7 +161688,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152802,7 +161701,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152821,7 +161724,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152830,7 +161737,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152849,7 +161760,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152858,7 +161773,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152877,7 +161796,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152886,7 +161809,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152905,7 +161832,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152914,7 +161845,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152933,7 +161868,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152942,7 +161881,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152961,7 +161904,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152970,7 +161917,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -152989,7 +161940,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -152998,7 +161953,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153017,7 +161976,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153026,7 +161989,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153045,7 +162012,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153054,7 +162025,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153073,7 +162048,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153082,7 +162061,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153101,7 +162084,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153110,7 +162097,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153129,7 +162120,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153138,7 +162133,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153157,7 +162156,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153166,7 +162169,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153185,7 +162192,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153194,7 +162205,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153213,7 +162228,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153222,7 +162241,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153241,7 +162264,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153250,7 +162277,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153269,7 +162300,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153278,7 +162313,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153297,7 +162336,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153306,7 +162349,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153325,7 +162372,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153334,7 +162385,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153353,7 +162408,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153362,7 +162421,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153381,7 +162444,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153390,7 +162457,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153409,7 +162480,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153418,7 +162493,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153437,7 +162516,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153446,7 +162529,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153465,7 +162552,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153474,7 +162565,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153493,7 +162588,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153502,7 +162601,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153521,7 +162624,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153530,7 +162637,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153549,7 +162660,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153558,7 +162673,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153577,7 +162696,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153586,7 +162709,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153605,7 +162732,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153614,7 +162745,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153633,7 +162768,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153642,7 +162781,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153661,7 +162804,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153670,7 +162817,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153689,7 +162840,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153698,7 +162853,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153717,7 +162876,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153726,7 +162889,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -153745,7 +162912,11 @@ T1584.004,No,-,5
 T1587,No,-,5
 T1102.001,No,-,5
 T1560.003,No,-,5
-T1069.002,No,-,5
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1218.007,No,-,5
 T1572,No,-,5
 T1071.003,No,-,5
@@ -153754,7 +162925,11 @@ T1021.006,No,-,5
 T1568,No,-,5
 T1188,No,-,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml,4
-T1069.001,No,-,5
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,0
+T1069.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,0
 T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml,4
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml,1
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml,1
@@ -167724,7 +176899,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167735,9 +176910,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -167773,7 +176953,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167784,9 +176964,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -167822,7 +177007,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167833,9 +177018,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -167871,7 +177061,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167882,9 +177072,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -167920,7 +177115,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167931,9 +177126,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -167969,7 +177169,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -167980,9 +177180,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168018,7 +177223,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168029,9 +177234,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168067,7 +177277,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168078,9 +177288,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168116,7 +177331,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168127,9 +177342,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168165,7 +177385,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168176,9 +177396,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168214,7 +177439,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168225,9 +177450,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168263,7 +177493,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168274,9 +177504,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168312,7 +177547,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168323,9 +177558,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168361,7 +177601,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168372,9 +177612,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168410,7 +177655,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168421,9 +177666,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168459,7 +177709,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168470,9 +177720,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168508,7 +177763,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168519,9 +177774,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168557,7 +177817,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168568,9 +177828,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168606,7 +177871,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168617,9 +177882,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168655,7 +177925,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168666,9 +177936,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168704,7 +177979,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168715,9 +177990,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168753,7 +178033,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168764,9 +178044,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168802,7 +178087,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168813,9 +178098,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168851,7 +178141,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168862,9 +178152,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168900,7 +178195,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168911,9 +178206,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168949,7 +178249,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -168960,9 +178260,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -168998,7 +178303,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169009,9 +178314,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169047,7 +178357,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169058,9 +178368,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169096,7 +178411,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169107,9 +178422,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169145,7 +178465,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169156,9 +178476,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169194,7 +178519,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169205,9 +178530,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169243,7 +178573,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169254,9 +178584,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169292,7 +178627,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169303,9 +178638,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169341,7 +178681,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169352,9 +178692,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169390,7 +178735,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169401,9 +178746,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169439,7 +178789,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169450,9 +178800,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169488,7 +178843,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169499,9 +178854,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169537,7 +178897,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169548,9 +178908,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169586,7 +178951,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169597,9 +178962,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169635,7 +179005,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169646,9 +179016,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169684,7 +179059,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169695,9 +179070,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169733,7 +179113,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169744,9 +179124,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169782,7 +179167,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169793,9 +179178,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169831,7 +179221,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169842,9 +179232,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169880,7 +179275,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169891,9 +179286,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169929,7 +179329,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169940,9 +179340,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -169978,7 +179383,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -169989,9 +179394,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170027,7 +179437,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170038,9 +179448,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170076,7 +179491,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170087,9 +179502,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170125,7 +179545,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170136,9 +179556,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170174,7 +179599,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170185,9 +179610,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170223,7 +179653,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170234,9 +179664,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170272,7 +179707,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170283,9 +179718,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170321,7 +179761,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170332,9 +179772,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170370,7 +179815,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170381,9 +179826,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170419,7 +179869,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170430,9 +179880,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170468,7 +179923,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170479,9 +179934,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170517,7 +179977,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170528,9 +179988,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170566,7 +180031,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170577,9 +180042,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170615,7 +180085,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170626,9 +180096,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170664,7 +180139,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170675,9 +180150,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170713,7 +180193,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170724,9 +180204,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170762,7 +180247,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170773,9 +180258,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170811,7 +180301,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170822,9 +180312,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170860,7 +180355,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170871,9 +180366,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170909,7 +180409,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170920,9 +180420,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -170958,7 +180463,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -170969,9 +180474,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171007,7 +180517,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171018,9 +180528,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171056,7 +180571,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171067,9 +180582,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171105,7 +180625,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171116,9 +180636,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171154,7 +180679,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171165,9 +180690,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171203,7 +180733,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171214,9 +180744,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171252,7 +180787,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171263,9 +180798,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171301,7 +180841,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171312,9 +180852,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171350,7 +180895,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171361,9 +180906,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171399,7 +180949,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171410,9 +180960,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171448,7 +181003,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171459,9 +181014,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171497,7 +181057,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171508,9 +181068,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171546,7 +181111,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171557,9 +181122,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171595,7 +181165,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171606,9 +181176,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171644,7 +181219,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171655,9 +181230,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171693,7 +181273,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171704,9 +181284,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171742,7 +181327,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171753,9 +181338,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171791,7 +181381,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171802,9 +181392,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171840,7 +181435,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171851,9 +181446,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171889,7 +181489,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171900,9 +181500,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171938,7 +181543,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171949,9 +181554,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -171987,7 +181597,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -171998,9 +181608,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172036,7 +181651,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172047,9 +181662,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172085,7 +181705,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172096,9 +181716,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172134,7 +181759,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172145,9 +181770,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172183,7 +181813,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172194,9 +181824,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172232,7 +181867,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172243,9 +181878,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172281,7 +181921,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172292,9 +181932,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172330,7 +181975,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172341,9 +181986,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172379,7 +182029,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172390,9 +182040,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172428,7 +182083,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172439,9 +182094,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172477,7 +182137,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172488,9 +182148,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172526,7 +182191,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172537,9 +182202,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172575,7 +182245,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172586,9 +182256,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172624,7 +182299,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172635,9 +182310,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172673,7 +182353,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172684,9 +182364,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172722,7 +182407,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172733,9 +182418,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172771,7 +182461,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172782,9 +182472,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172820,7 +182515,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172831,9 +182526,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172869,7 +182569,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172880,9 +182580,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172918,7 +182623,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172929,9 +182634,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -172967,7 +182677,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -172978,9 +182688,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173016,7 +182731,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173027,9 +182742,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173065,7 +182785,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173076,9 +182796,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173114,7 +182839,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173125,9 +182850,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173163,7 +182893,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173174,9 +182904,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173212,7 +182947,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173223,9 +182958,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173261,7 +183001,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173272,9 +183012,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173310,7 +183055,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173321,9 +183066,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173359,7 +183109,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173370,9 +183120,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173408,7 +183163,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173419,9 +183174,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173457,7 +183217,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173468,9 +183228,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173506,7 +183271,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173517,9 +183282,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173555,7 +183325,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173566,9 +183336,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173604,7 +183379,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173615,9 +183390,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173653,7 +183433,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173664,9 +183444,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173702,7 +183487,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173713,9 +183498,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173751,7 +183541,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173762,9 +183552,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173800,7 +183595,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173811,9 +183606,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173849,7 +183649,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173860,9 +183660,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173898,7 +183703,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173909,9 +183714,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173947,7 +183757,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -173958,9 +183768,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -173996,7 +183811,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174007,9 +183822,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174045,7 +183865,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174056,9 +183876,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174094,7 +183919,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174105,9 +183930,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174143,7 +183973,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174154,9 +183984,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174192,7 +184027,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174203,9 +184038,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174241,7 +184081,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174252,9 +184092,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174290,7 +184135,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174301,9 +184146,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174339,7 +184189,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174350,9 +184200,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174388,7 +184243,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174399,9 +184254,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174437,7 +184297,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174448,9 +184308,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174486,7 +184351,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174497,9 +184362,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174535,7 +184405,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174546,9 +184416,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174584,7 +184459,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174595,9 +184470,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174633,7 +184513,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174644,9 +184524,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174682,7 +184567,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174693,9 +184578,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174731,7 +184621,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174742,9 +184632,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174780,7 +184675,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174791,9 +184686,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174829,7 +184729,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174840,9 +184740,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174878,7 +184783,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174889,9 +184794,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174927,7 +184837,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174938,9 +184848,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -174976,7 +184891,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -174987,9 +184902,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175025,7 +184945,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175036,9 +184956,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175074,7 +184999,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175085,9 +185010,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175123,7 +185053,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175134,9 +185064,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175172,7 +185107,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175183,9 +185118,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175221,7 +185161,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175232,9 +185172,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175270,7 +185215,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175281,9 +185226,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175319,7 +185269,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175330,9 +185280,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175368,7 +185323,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175379,9 +185334,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175417,7 +185377,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175428,9 +185388,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175466,7 +185431,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175477,9 +185442,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175515,7 +185485,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175526,9 +185496,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175564,7 +185539,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175575,9 +185550,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175613,7 +185593,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175624,9 +185604,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175662,7 +185647,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175673,9 +185658,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175711,7 +185701,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175722,9 +185712,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175760,7 +185755,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175771,9 +185766,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175809,7 +185809,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175820,9 +185820,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175858,7 +185863,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175869,9 +185874,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175907,7 +185917,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175918,9 +185928,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -175956,7 +185971,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -175967,9 +185982,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176005,7 +186025,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176016,9 +186036,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176054,7 +186079,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176065,9 +186090,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176103,7 +186133,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176114,9 +186144,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176152,7 +186187,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176163,9 +186198,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176201,7 +186241,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176212,9 +186252,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176250,7 +186295,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176261,9 +186306,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176299,7 +186349,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176310,9 +186360,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176348,7 +186403,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176359,9 +186414,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176397,7 +186457,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176408,9 +186468,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176446,7 +186511,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176457,9 +186522,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176495,7 +186565,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176506,9 +186576,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176544,7 +186619,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176555,9 +186630,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176593,7 +186673,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176604,9 +186684,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176642,7 +186727,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176653,9 +186738,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176691,7 +186781,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176702,9 +186792,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176740,7 +186835,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176751,9 +186846,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176789,7 +186889,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176800,9 +186900,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176838,7 +186943,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176849,9 +186954,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176887,7 +186997,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176898,9 +187008,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176936,7 +187051,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176947,9 +187062,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -176985,7 +187105,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -176996,9 +187116,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177034,7 +187159,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177045,9 +187170,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177083,7 +187213,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177094,9 +187224,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177132,7 +187267,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177143,9 +187278,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177181,7 +187321,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177192,9 +187332,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177230,7 +187375,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177241,9 +187386,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177279,7 +187429,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177290,9 +187440,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177328,7 +187483,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177339,9 +187494,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177377,7 +187537,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177388,9 +187548,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177426,7 +187591,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177437,9 +187602,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177475,7 +187645,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177486,9 +187656,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177524,7 +187699,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177535,9 +187710,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177573,7 +187753,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177584,9 +187764,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177622,7 +187807,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177633,9 +187818,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177671,7 +187861,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177682,9 +187872,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177720,7 +187915,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177731,9 +187926,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177769,7 +187969,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177780,9 +187980,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177818,7 +188023,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177829,9 +188034,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177867,7 +188077,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177878,9 +188088,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177916,7 +188131,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177927,9 +188142,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -177965,7 +188185,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -177976,9 +188196,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178014,7 +188239,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178025,9 +188250,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178063,7 +188293,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178074,9 +188304,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178112,7 +188347,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178123,9 +188358,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178161,7 +188401,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178172,9 +188412,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178210,7 +188455,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178221,9 +188466,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178259,7 +188509,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178270,9 +188520,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178308,7 +188563,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178319,9 +188574,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178357,7 +188617,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178368,9 +188628,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178406,7 +188671,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178417,9 +188682,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178455,7 +188725,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178466,9 +188736,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178504,7 +188779,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178515,9 +188790,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178553,7 +188833,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178564,9 +188844,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178602,7 +188887,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178613,9 +188898,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178651,7 +188941,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178662,9 +188952,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178700,7 +188995,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178711,9 +189006,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178749,7 +189049,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178760,9 +189060,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178798,7 +189103,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178809,9 +189114,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178847,7 +189157,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178858,9 +189168,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178896,7 +189211,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178907,9 +189222,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178945,7 +189265,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -178956,9 +189276,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -178994,7 +189319,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179005,9 +189330,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179043,7 +189373,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179054,9 +189384,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179092,7 +189427,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179103,9 +189438,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179141,7 +189481,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179152,9 +189492,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179190,7 +189535,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179201,9 +189546,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179239,7 +189589,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179250,9 +189600,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179288,7 +189643,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179299,9 +189654,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179337,7 +189697,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179348,9 +189708,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179386,7 +189751,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179397,9 +189762,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179435,7 +189805,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179446,9 +189816,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179484,7 +189859,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179495,9 +189870,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179533,7 +189913,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179544,9 +189924,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179582,7 +189967,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179593,9 +189978,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179631,7 +190021,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179642,9 +190032,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179680,7 +190075,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179691,9 +190086,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179729,7 +190129,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179740,9 +190140,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179778,7 +190183,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179789,9 +190194,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179827,7 +190237,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179838,9 +190248,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179876,7 +190291,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179887,9 +190302,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179925,7 +190345,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179936,9 +190356,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -179974,7 +190399,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -179985,9 +190410,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180023,7 +190453,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180034,9 +190464,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180072,7 +190507,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180083,9 +190518,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180121,7 +190561,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180132,9 +190572,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180170,7 +190615,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180181,9 +190626,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180219,7 +190669,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180230,9 +190680,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180268,7 +190723,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180279,9 +190734,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180317,7 +190777,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180328,9 +190788,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180366,7 +190831,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180377,9 +190842,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180415,7 +190885,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180426,9 +190896,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180464,7 +190939,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180475,9 +190950,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180513,7 +190993,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180524,9 +191004,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180562,7 +191047,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180573,9 +191058,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180611,7 +191101,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180622,9 +191112,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180660,7 +191155,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180671,9 +191166,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180709,7 +191209,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180720,9 +191220,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180758,7 +191263,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180769,9 +191274,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180807,7 +191317,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180818,9 +191328,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180856,7 +191371,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180867,9 +191382,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180905,7 +191425,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180916,9 +191436,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -180954,7 +191479,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -180965,9 +191490,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181003,7 +191533,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181014,9 +191544,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181052,7 +191587,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181063,9 +191598,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181101,7 +191641,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181112,9 +191652,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181150,7 +191695,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181161,9 +191706,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181199,7 +191749,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181210,9 +191760,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181248,7 +191803,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181259,9 +191814,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181297,7 +191857,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181308,9 +191868,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181346,7 +191911,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181357,9 +191922,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181395,7 +191965,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181406,9 +191976,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181444,7 +192019,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181455,9 +192030,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181493,7 +192073,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181504,9 +192084,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181542,7 +192127,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181553,9 +192138,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181591,7 +192181,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181602,9 +192192,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181640,7 +192235,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181651,9 +192246,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181689,7 +192289,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181700,9 +192300,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181738,7 +192343,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181749,9 +192354,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181787,7 +192397,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181798,9 +192408,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181836,7 +192451,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181847,9 +192462,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181885,7 +192505,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181896,9 +192516,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181934,7 +192559,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181945,9 +192570,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -181983,7 +192613,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -181994,9 +192624,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182032,7 +192667,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182043,9 +192678,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182081,7 +192721,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182092,9 +192732,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182130,7 +192775,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182141,9 +192786,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182179,7 +192829,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182190,9 +192840,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182228,7 +192883,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182239,9 +192894,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182277,7 +192937,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182288,9 +192948,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182326,7 +192991,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182337,9 +193002,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182375,7 +193045,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182386,9 +193056,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182424,7 +193099,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182435,9 +193110,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182473,7 +193153,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182484,9 +193164,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182522,7 +193207,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182533,9 +193218,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182571,7 +193261,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182582,9 +193272,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182620,7 +193315,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182631,9 +193326,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182669,7 +193369,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182680,9 +193380,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182718,7 +193423,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182729,9 +193434,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182767,7 +193477,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182778,9 +193488,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182816,7 +193531,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182827,9 +193542,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182865,7 +193585,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182876,9 +193596,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182914,7 +193639,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182925,9 +193650,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -182963,7 +193693,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -182974,9 +193704,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183012,7 +193747,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183023,9 +193758,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183061,7 +193801,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183072,9 +193812,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183110,7 +193855,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183121,9 +193866,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183159,7 +193909,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183170,9 +193920,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183208,7 +193963,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183219,9 +193974,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183257,7 +194017,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183268,9 +194028,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183306,7 +194071,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183317,9 +194082,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183355,7 +194125,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183366,9 +194136,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183404,7 +194179,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183415,9 +194190,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183453,7 +194233,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183464,9 +194244,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183502,7 +194287,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183513,9 +194298,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183551,7 +194341,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183562,9 +194352,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183600,7 +194395,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183611,9 +194406,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183649,7 +194449,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183660,9 +194460,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183698,7 +194503,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183709,9 +194514,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183747,7 +194557,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183758,9 +194568,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183796,7 +194611,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183807,9 +194622,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183845,7 +194665,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183856,9 +194676,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183894,7 +194719,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183905,9 +194730,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183943,7 +194773,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -183954,9 +194784,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -183992,7 +194827,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184003,9 +194838,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184041,7 +194881,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184052,9 +194892,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184090,7 +194935,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184101,9 +194946,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184139,7 +194989,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184150,9 +195000,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184188,7 +195043,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184199,9 +195054,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184237,7 +195097,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184248,9 +195108,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184286,7 +195151,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184297,9 +195162,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184335,7 +195205,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184346,9 +195216,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184384,7 +195259,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184395,9 +195270,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184433,7 +195313,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184444,9 +195324,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184482,7 +195367,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184493,9 +195378,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184531,7 +195421,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184542,9 +195432,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184580,7 +195475,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184591,9 +195486,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184629,7 +195529,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184640,9 +195540,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184678,7 +195583,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184689,9 +195594,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184727,7 +195637,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184738,9 +195648,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184776,7 +195691,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184787,9 +195702,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184825,7 +195745,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184836,9 +195756,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184874,7 +195799,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184885,9 +195810,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184923,7 +195853,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184934,9 +195864,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -184972,7 +195907,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -184983,9 +195918,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185021,7 +195961,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185032,9 +195972,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185070,7 +196015,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185081,9 +196026,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185119,7 +196069,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185130,9 +196080,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185168,7 +196123,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185179,9 +196134,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185217,7 +196177,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185228,9 +196188,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185266,7 +196231,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185277,9 +196242,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185315,7 +196285,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185326,9 +196296,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185364,7 +196339,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185375,9 +196350,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185413,7 +196393,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185424,9 +196404,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185462,7 +196447,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185473,9 +196458,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185511,7 +196501,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185522,9 +196512,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185560,7 +196555,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185571,9 +196566,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185609,7 +196609,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185620,9 +196620,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185658,7 +196663,7 @@ T1213.002,No,-,3
 T1016.001,No,-,3
 T1542.003,No,-,3
 T1025,No,-,3
-T1114.001,No,-,3
+T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml,2
 T1080,No,-,3
 T1497.001,No,-,3
 T1115,No,-,3
@@ -185669,9 +196674,14 @@ T1562.002,No,-,3
 T1004,No,-,3
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
 T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml,-5
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-5
 T1583.003,No,-,3
 T1550.003,No,-,3
 T1074,No,-,3
@@ -185722,7 +196732,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185773,7 +196784,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185824,7 +196836,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185875,7 +196888,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185926,7 +196940,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185977,7 +196992,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186028,7 +197044,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186079,7 +197096,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186130,7 +197148,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186181,7 +197200,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186232,7 +197252,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186283,7 +197304,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186334,7 +197356,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186385,7 +197408,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186436,7 +197460,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186487,7 +197512,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186538,7 +197564,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186589,7 +197616,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186640,7 +197668,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186691,7 +197720,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186742,7 +197772,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186793,7 +197824,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186844,7 +197876,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186895,7 +197928,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186946,7 +197980,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186997,7 +198032,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187048,7 +198084,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187099,7 +198136,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187150,7 +198188,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187201,7 +198240,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187252,7 +198292,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187303,7 +198344,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187354,7 +198396,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187405,7 +198448,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187456,7 +198500,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187507,7 +198552,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187558,7 +198604,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187609,7 +198656,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187660,7 +198708,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187711,7 +198760,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187762,7 +198812,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187813,7 +198864,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187864,7 +198916,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187915,7 +198968,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187966,7 +199020,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188017,7 +199072,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188068,7 +199124,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188119,7 +199176,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188170,7 +199228,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188221,7 +199280,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188272,7 +199332,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188323,7 +199384,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188374,7 +199436,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188425,7 +199488,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188476,7 +199540,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188527,7 +199592,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188578,7 +199644,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188629,7 +199696,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188680,7 +199748,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188731,7 +199800,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188782,7 +199852,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188833,7 +199904,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188884,7 +199956,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188935,7 +200008,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188986,7 +200060,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189037,7 +200112,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189088,7 +200164,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189139,7 +200216,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189190,7 +200268,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189241,7 +200320,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189292,7 +200372,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189343,7 +200424,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189394,7 +200476,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189445,7 +200528,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189496,7 +200580,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189547,7 +200632,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189598,7 +200684,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189649,7 +200736,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189700,7 +200788,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189751,7 +200840,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189802,7 +200892,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189853,7 +200944,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189904,7 +200996,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189955,7 +201048,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190006,7 +201100,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190057,7 +201152,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190108,7 +201204,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190159,7 +201256,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190210,7 +201308,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190261,7 +201360,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190312,7 +201412,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190363,7 +201464,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190414,7 +201516,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190465,7 +201568,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190516,7 +201620,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190567,7 +201672,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190618,7 +201724,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190669,7 +201776,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190720,7 +201828,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190771,7 +201880,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190822,7 +201932,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190873,7 +201984,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190924,7 +202036,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190975,7 +202088,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191026,7 +202140,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191077,7 +202192,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191128,7 +202244,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191179,7 +202296,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191230,7 +202348,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191281,7 +202400,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191332,7 +202452,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191383,7 +202504,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191434,7 +202556,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191485,7 +202608,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191536,7 +202660,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191587,7 +202712,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191638,7 +202764,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191689,7 +202816,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191740,7 +202868,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191791,7 +202920,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191842,7 +202972,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191893,7 +203024,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191944,7 +203076,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191995,7 +203128,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192046,7 +203180,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192097,7 +203232,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192148,7 +203284,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192199,7 +203336,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192250,7 +203388,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192301,7 +203440,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192352,7 +203492,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192403,7 +203544,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192454,7 +203596,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192505,7 +203648,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192556,7 +203700,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192607,7 +203752,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192658,7 +203804,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192709,7 +203856,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192760,7 +203908,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192811,7 +203960,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192862,7 +204012,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192913,7 +204064,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192964,7 +204116,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193015,7 +204168,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193066,7 +204220,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193117,7 +204272,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193168,7 +204324,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193219,7 +204376,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193270,7 +204428,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193321,7 +204480,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193372,7 +204532,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193423,7 +204584,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193474,7 +204636,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193525,7 +204688,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193576,7 +204740,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193627,7 +204792,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193678,7 +204844,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193729,7 +204896,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193780,7 +204948,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193831,7 +205000,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193882,7 +205052,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193933,7 +205104,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193984,7 +205156,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194035,7 +205208,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194086,7 +205260,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194137,7 +205312,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194188,7 +205364,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194239,7 +205416,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194290,7 +205468,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194341,7 +205520,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194392,7 +205572,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194443,7 +205624,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194494,7 +205676,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194545,7 +205728,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194596,7 +205780,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194647,7 +205832,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194698,7 +205884,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194749,7 +205936,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194800,7 +205988,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194851,7 +206040,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194902,7 +206092,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194953,7 +206144,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195004,7 +206196,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195055,7 +206248,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195106,7 +206300,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195157,7 +206352,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195208,7 +206404,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195259,7 +206456,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195310,7 +206508,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195361,7 +206560,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195412,7 +206612,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195463,7 +206664,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195514,7 +206716,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195565,7 +206768,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195616,7 +206820,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195667,7 +206872,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195718,7 +206924,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195769,7 +206976,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195820,7 +207028,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195871,7 +207080,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195922,7 +207132,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -195973,7 +207184,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196024,7 +207236,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196075,7 +207288,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196126,7 +207340,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196177,7 +207392,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196228,7 +207444,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196279,7 +207496,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196330,7 +207548,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196381,7 +207600,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196432,7 +207652,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196483,7 +207704,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196534,7 +207756,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196585,7 +207808,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196636,7 +207860,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196687,7 +207912,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196738,7 +207964,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196789,7 +208016,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196840,7 +208068,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196891,7 +208120,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196942,7 +208172,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -196993,7 +208224,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197044,7 +208276,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197095,7 +208328,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197146,7 +208380,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197197,7 +208432,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197248,7 +208484,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197299,7 +208536,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197350,7 +208588,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197401,7 +208640,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197452,7 +208692,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197503,7 +208744,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197554,7 +208796,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197605,7 +208848,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197656,7 +208900,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197707,7 +208952,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197758,7 +209004,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197809,7 +209056,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197860,7 +209108,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197911,7 +209160,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -197962,7 +209212,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198013,7 +209264,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198064,7 +209316,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198115,7 +209368,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198166,7 +209420,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198217,7 +209472,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198268,7 +209524,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198319,7 +209576,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198370,7 +209628,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198421,7 +209680,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198472,7 +209732,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198523,7 +209784,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198574,7 +209836,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198625,7 +209888,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198676,7 +209940,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198727,7 +209992,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198778,7 +210044,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198829,7 +210096,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198880,7 +210148,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198931,7 +210200,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -198982,7 +210252,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199033,7 +210304,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199084,7 +210356,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199135,7 +210408,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199186,7 +210460,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199237,7 +210512,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199288,7 +210564,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199339,7 +210616,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199390,7 +210668,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199441,7 +210720,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199492,7 +210772,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199543,7 +210824,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199594,7 +210876,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199645,7 +210928,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199696,7 +210980,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199747,7 +211032,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199798,7 +211084,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199849,7 +211136,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199900,7 +211188,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -199951,7 +211240,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200002,7 +211292,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200053,7 +211344,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200104,7 +211396,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200155,7 +211448,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200206,7 +211500,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200257,7 +211552,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200308,7 +211604,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200359,7 +211656,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200410,7 +211708,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200461,7 +211760,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200512,7 +211812,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200563,7 +211864,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200614,7 +211916,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200665,7 +211968,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200716,7 +212020,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200767,7 +212072,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200818,7 +212124,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200869,7 +212176,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200920,7 +212228,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -200971,7 +212280,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201022,7 +212332,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201073,7 +212384,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201124,7 +212436,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201175,7 +212488,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201226,7 +212540,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201277,7 +212592,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201328,7 +212644,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201379,7 +212696,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201430,7 +212748,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201481,7 +212800,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201532,7 +212852,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201583,7 +212904,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201634,7 +212956,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201685,7 +213008,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201736,7 +213060,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201787,7 +213112,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201838,7 +213164,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201889,7 +213216,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201940,7 +213268,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -201991,7 +213320,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202042,7 +213372,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202093,7 +213424,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202144,7 +213476,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202195,7 +213528,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202246,7 +213580,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202297,7 +213632,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202348,7 +213684,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202399,7 +213736,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202450,7 +213788,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202501,7 +213840,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202552,7 +213892,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202603,7 +213944,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202654,7 +213996,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202705,7 +214048,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202756,7 +214100,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202807,7 +214152,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202858,7 +214204,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202909,7 +214256,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -202960,7 +214308,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203011,7 +214360,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203062,7 +214412,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203113,7 +214464,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203164,7 +214516,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203215,7 +214568,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203266,7 +214620,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203317,7 +214672,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203368,7 +214724,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203419,7 +214776,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203470,7 +214828,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203521,7 +214880,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203572,7 +214932,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203623,7 +214984,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203674,7 +215036,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203725,7 +215088,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203776,7 +215140,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203827,7 +215192,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203878,7 +215244,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203929,7 +215296,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -203980,7 +215348,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204031,7 +215400,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204082,7 +215452,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204133,7 +215504,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204184,7 +215556,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204235,7 +215608,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204286,7 +215660,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204337,7 +215712,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -204388,7 +215764,8 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,1
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml,0
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json
index 72266d2123..d8d248e3e7 100644
--- a/docs/mitre-map/detections.json
+++ b/docs/mitre-map/detections.json
@@ -16521,2205 +16521,2205 @@
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1059.003",
-            "score": 48,
+            "score": 47,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
         {
             "techniqueID": "T1060",
@@ -59460,1838 +59460,2205 @@
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1033",
-            "score": 25,
-            "showSubtechniques": false
+            "score": 24,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml"
         },
         {
             "techniqueID": "T1140",
@@ -65332,2205 +65699,2205 @@
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1560.001",
-            "score": 22,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67556,35 +67923,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67610,8 +67951,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67637,8 +67979,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67664,8 +68007,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67691,8 +68035,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67718,8 +68063,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67745,8 +68091,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67772,8 +68119,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67799,8 +68147,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67826,8 +68175,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67853,8 +68203,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67880,8 +68231,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67907,8 +68259,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67934,8 +68287,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67961,8 +68315,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -67988,8 +68343,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68015,8 +68371,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68042,8 +68399,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68069,8 +68427,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68096,8 +68455,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68123,8 +68483,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68150,8 +68511,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68177,8 +68539,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68204,8 +68567,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68231,8 +68595,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68258,8 +68623,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68285,8 +68651,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68312,8 +68679,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68339,8 +68707,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68366,8 +68735,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68393,8 +68763,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68420,8 +68791,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68447,8 +68819,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68474,8 +68847,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68501,8 +68875,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68528,8 +68903,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68555,8 +68931,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68582,8 +68959,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68609,8 +68987,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68636,8 +69015,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68663,8 +69043,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68690,8 +69071,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68717,8 +69099,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68744,8 +69127,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68771,8 +69155,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68798,8 +69183,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68825,8 +69211,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68852,8 +69239,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68879,8 +69267,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68906,8 +69295,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68933,8 +69323,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68960,8 +69351,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -68987,8 +69379,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69014,8 +69407,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69041,8 +69435,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69068,8 +69463,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69095,8 +69491,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69122,8 +69519,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69149,35 +69547,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69203,8 +69575,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69230,8 +69603,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69257,8 +69631,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69284,8 +69659,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69311,8 +69687,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69338,8 +69715,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69365,8 +69743,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69392,8 +69771,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69419,8 +69799,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69446,8 +69827,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69473,8 +69855,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69500,8 +69883,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69527,8 +69911,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69554,8 +69939,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69581,8 +69967,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69608,8 +69995,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69635,8 +70023,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69662,8 +70051,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69689,8 +70079,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69716,8 +70107,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69743,8 +70135,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69770,8 +70163,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69797,8 +70191,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69824,8 +70219,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69851,8 +70247,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69878,8 +70275,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69905,8 +70303,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69932,8 +70331,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69959,8 +70359,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -69986,8 +70387,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70013,8 +70415,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70040,8 +70443,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70067,8 +70471,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70094,8 +70499,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70121,8 +70527,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70148,8 +70555,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70175,8 +70583,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70202,8 +70611,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70229,8 +70639,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70256,8 +70667,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70283,8 +70695,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70310,8 +70723,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70337,8 +70751,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70364,8 +70779,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70391,8 +70807,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70418,8 +70835,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70445,8 +70863,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70472,8 +70891,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70499,8 +70919,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70526,8 +70947,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70553,8 +70975,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70580,8 +71003,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70607,8 +71031,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70634,8 +71059,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70661,8 +71087,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70688,8 +71115,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70715,8 +71143,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70742,35 +71171,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70796,8 +71199,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70823,8 +71227,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70850,8 +71255,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70877,8 +71283,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70904,8 +71311,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70931,8 +71339,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70958,8 +71367,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -70985,8 +71395,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71012,8 +71423,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71039,8 +71451,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71066,8 +71479,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71093,8 +71507,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71120,8 +71535,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71147,8 +71563,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71174,8 +71591,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71201,8 +71619,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71228,8 +71647,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71255,8 +71675,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71282,8 +71703,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71309,8 +71731,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71336,8 +71759,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71363,8 +71787,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71390,8 +71815,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71417,8 +71843,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71444,8 +71871,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71471,8 +71899,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71498,8 +71927,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71525,8 +71955,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71552,8 +71983,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71579,8 +72011,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71606,8 +72039,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71633,8 +72067,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71660,8 +72095,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71687,8 +72123,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71714,8 +72151,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71741,8 +72179,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71768,8 +72207,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71795,8 +72235,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71822,8 +72263,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71849,8 +72291,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71876,8 +72319,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71903,8 +72347,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71930,8 +72375,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71957,8 +72403,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -71984,8 +72431,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72011,8 +72459,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72038,8 +72487,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72065,8 +72515,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72092,8 +72543,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72119,8 +72571,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72146,8 +72599,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72173,8 +72627,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72200,8 +72655,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72227,8 +72683,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72254,8 +72711,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72281,8 +72739,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72308,8 +72767,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72335,35 +72795,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72389,8 +72823,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72416,8 +72851,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72443,8 +72879,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72470,8 +72907,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72497,8 +72935,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72524,8 +72963,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72551,8 +72991,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72578,8 +73019,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72605,8 +73047,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72632,8 +73075,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72659,8 +73103,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72686,8 +73131,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72713,8 +73159,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72740,8 +73187,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72767,8 +73215,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72794,8 +73243,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72821,8 +73271,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72848,8 +73299,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72875,8 +73327,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72902,8 +73355,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72929,8 +73383,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72956,8 +73411,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -72983,8 +73439,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73010,8 +73467,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73037,8 +73495,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73064,8 +73523,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73091,8 +73551,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73118,8 +73579,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73145,8 +73607,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73172,8 +73635,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73199,8 +73663,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73226,8 +73691,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73253,8 +73719,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73280,8 +73747,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73307,8 +73775,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73334,8 +73803,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73361,8 +73831,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73388,8 +73859,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73415,8 +73887,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73442,8 +73915,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73469,8 +73943,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73496,8 +73971,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73523,8 +73999,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73550,8 +74027,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73577,8 +74055,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73604,8 +74083,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73631,8 +74111,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73658,8 +74139,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73685,8 +74167,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73712,8 +74195,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73739,8 +74223,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73766,8 +74251,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73793,8 +74279,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73820,8 +74307,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73847,8 +74335,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73874,8 +74363,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73901,8 +74391,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73928,35 +74419,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -73982,8 +74447,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74009,8 +74475,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74036,8 +74503,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74063,8 +74531,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74090,8 +74559,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74117,8 +74587,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74144,8 +74615,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74171,8 +74643,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74198,8 +74671,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74225,8 +74699,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74252,8 +74727,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74279,8 +74755,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74306,8 +74783,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74333,8 +74811,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74360,8 +74839,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74387,8 +74867,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74414,8 +74895,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74441,8 +74923,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74468,8 +74951,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74495,8 +74979,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74522,8 +75007,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74549,8 +75035,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74576,8 +75063,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74603,8 +75091,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74630,8 +75119,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74657,8 +75147,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74684,8 +75175,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74711,8 +75203,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74738,8 +75231,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74765,8 +75259,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74792,8 +75287,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74819,8 +75315,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74846,8 +75343,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74873,8 +75371,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74900,8 +75399,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74927,8 +75427,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74954,8 +75455,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -74981,8 +75483,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75008,8 +75511,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75035,8 +75539,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75062,8 +75567,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75089,8 +75595,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75116,8 +75623,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75143,8 +75651,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75170,8 +75679,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75197,8 +75707,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75224,8 +75735,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75251,8 +75763,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75278,8 +75791,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75305,8 +75819,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75332,8 +75847,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75359,8 +75875,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75386,8 +75903,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75413,8 +75931,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75440,8 +75959,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75467,8 +75987,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75494,8 +76015,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75521,35 +76043,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 8,
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75575,8 +76071,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75602,8 +76099,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75629,8 +76127,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75656,8 +76155,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75683,8 +76183,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75710,8 +76211,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75737,8 +76239,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75764,8 +76267,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75791,8 +76295,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75818,8 +76323,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75845,8 +76351,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75872,8 +76379,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75899,8 +76407,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75926,8 +76435,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75953,8 +76463,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -75980,8 +76491,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76007,8 +76519,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76034,8 +76547,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76061,8 +76575,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76088,8 +76603,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76115,8 +76631,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76142,8 +76659,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76169,8 +76687,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76196,8 +76715,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76223,8 +76743,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76250,8 +76771,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76277,8 +76799,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76304,8 +76827,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76331,8 +76855,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76358,8 +76883,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76385,8 +76911,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76412,8 +76939,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76439,8 +76967,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76466,8 +76995,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76493,8 +77023,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76520,8 +77051,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76547,8 +77079,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76574,8 +77107,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76601,8 +77135,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76628,8 +77163,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76655,8 +77191,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76682,8 +77219,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76709,8 +77247,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76736,8 +77275,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76763,8 +77303,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76790,8 +77331,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76817,8 +77359,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76844,8 +77387,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76871,8 +77415,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76898,8 +77443,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76925,8 +77471,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76952,8 +77499,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -76979,8 +77527,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77006,8 +77555,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77033,8 +77583,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77060,8 +77611,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77087,8 +77639,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77114,8 +77667,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77141,8 +77695,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77168,8 +77723,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77195,8 +77751,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77222,8 +77779,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77249,8 +77807,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77276,8 +77835,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77303,8 +77863,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77330,8 +77891,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77357,8 +77919,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77384,8 +77947,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77411,8 +77975,9 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
             "techniqueID": "T1047",
@@ -77438,224 +78003,393 @@
         },
         {
             "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
-        },
-        {
-            "techniqueID": "T1189",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
-        },
-        {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
+            "techniqueID": "T1021.001",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
-        },
-        {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
+            "techniqueID": "T1021.001",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
-        },
-        {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
+            "techniqueID": "T1021.001",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
-        },
-        {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
+            "techniqueID": "T1021.001",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
+            "techniqueID": "T1021.001",
+            "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1047",
+            "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
-            "score": 20,
+            "techniqueID": "T1055",
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml"
         },
         {
-            "techniqueID": "T1059",
-            "score": 16,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1189",
+            "techniqueID": "T1021.001",
             "score": 20,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml"
+        },
+        {
+            "techniqueID": "T1189",
+            "score": 20,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml"
         },
         {
             "techniqueID": "T1059",
@@ -87362,9 +88096,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87378,9 +88112,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87394,9 +88128,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87410,9 +88144,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87426,9 +88160,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87442,9 +88176,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87458,9 +88192,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87474,9 +88208,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87490,9 +88224,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87506,9 +88240,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87522,9 +88256,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87538,9 +88272,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87554,9 +88288,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87570,9 +88304,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87586,9 +88320,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87602,9 +88336,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87618,9 +88352,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87634,9 +88368,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87650,9 +88384,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87666,9 +88400,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87682,9 +88416,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87698,9 +88432,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87714,9 +88448,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87730,9 +88464,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87746,9 +88480,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87762,9 +88496,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87778,9 +88512,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87794,9 +88528,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87810,9 +88544,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87826,9 +88560,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87842,9 +88576,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87858,9 +88592,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87874,9 +88608,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87890,9 +88624,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87906,9 +88640,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87922,9 +88656,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87938,9 +88672,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87954,9 +88688,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87970,9 +88704,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -87986,9 +88720,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88002,9 +88736,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88018,9 +88752,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88034,9 +88768,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88050,9 +88784,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88066,9 +88800,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88082,9 +88816,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88098,9 +88832,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88114,9 +88848,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88130,9 +88864,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88146,9 +88880,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88162,9 +88896,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88178,9 +88912,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88194,9 +88928,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88210,9 +88944,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88226,9 +88960,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88242,9 +88976,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88258,9 +88992,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88274,9 +89008,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88290,9 +89024,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88306,9 +89040,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88322,9 +89056,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88338,9 +89072,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88354,9 +89088,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88370,9 +89104,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88386,9 +89120,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88402,9 +89136,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88418,9 +89152,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88434,9 +89168,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88450,9 +89184,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88466,9 +89200,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88482,9 +89216,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88498,9 +89232,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88514,9 +89248,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88530,9 +89264,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88546,9 +89280,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88562,9 +89296,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88578,9 +89312,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88594,9 +89328,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88610,9 +89344,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88626,9 +89360,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88642,9 +89376,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88658,9 +89392,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88674,9 +89408,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88690,9 +89424,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88706,9 +89440,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88722,9 +89456,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88738,9 +89472,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88754,9 +89488,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88770,9 +89504,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88786,9 +89520,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88802,9 +89536,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88818,9 +89552,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88834,9 +89568,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88850,9 +89584,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88866,9 +89600,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88882,9 +89616,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88898,9 +89632,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88914,9 +89648,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88930,9 +89664,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88946,9 +89680,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88962,9 +89696,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88978,9 +89712,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -88994,9 +89728,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89010,9 +89744,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89026,9 +89760,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89042,9 +89776,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89058,9 +89792,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89074,9 +89808,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89090,9 +89824,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89106,9 +89840,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89122,9 +89856,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89138,9 +89872,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89154,9 +89888,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89170,9 +89904,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89186,9 +89920,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89202,9 +89936,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89218,9 +89952,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89234,9 +89968,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89250,9 +89984,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89266,9 +90000,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89282,9 +90016,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89298,9 +90032,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89314,9 +90048,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89330,9 +90064,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89346,9 +90080,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89362,9 +90096,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89378,9 +90112,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89394,9 +90128,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89410,9 +90144,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89426,9 +90160,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89442,9 +90176,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89458,9 +90192,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89474,9 +90208,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89490,9 +90224,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89506,9 +90240,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89522,9 +90256,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89538,9 +90272,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89554,9 +90288,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89570,9 +90304,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89586,9 +90320,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89602,9 +90336,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89618,9 +90352,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89634,9 +90368,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89650,9 +90384,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89666,9 +90400,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89682,9 +90416,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89698,9 +90432,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89714,9 +90448,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89730,9 +90464,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89746,9 +90480,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89762,9 +90496,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89778,9 +90512,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89794,9 +90528,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89810,9 +90544,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89826,9 +90560,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89842,9 +90576,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89858,9 +90592,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89874,9 +90608,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89890,9 +90624,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89906,9 +90640,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89922,9 +90656,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89938,9 +90672,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89954,9 +90688,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89970,9 +90704,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -89986,9 +90720,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90002,9 +90736,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90018,9 +90752,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90034,9 +90768,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90050,9 +90784,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90066,9 +90800,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90082,9 +90816,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90098,9 +90832,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90114,9 +90848,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90130,9 +90864,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90146,9 +90880,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90162,9 +90896,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90178,9 +90912,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90194,9 +90928,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90210,9 +90944,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90226,9 +90960,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90242,9 +90976,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90258,9 +90992,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90274,9 +91008,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90290,9 +91024,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90306,9 +91040,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90322,9 +91056,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90338,9 +91072,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90354,9 +91088,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90370,9 +91104,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90386,9 +91120,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90402,9 +91136,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90418,9 +91152,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90434,9 +91168,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90450,9 +91184,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90466,9 +91200,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90482,9 +91216,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90498,9 +91232,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90514,9 +91248,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90530,9 +91264,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90546,9 +91280,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90562,9 +91296,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90578,9 +91312,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90594,9 +91328,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90610,9 +91344,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90626,9 +91360,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90642,9 +91376,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90658,9 +91392,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90674,9 +91408,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90690,9 +91424,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90706,9 +91440,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90722,9 +91456,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90738,9 +91472,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90754,9 +91488,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90770,9 +91504,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90786,9 +91520,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90802,9 +91536,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90818,9 +91552,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90834,9 +91568,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90850,9 +91584,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90866,9 +91600,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90882,9 +91616,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90898,9 +91632,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90914,9 +91648,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90930,9 +91664,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90946,9 +91680,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90962,9 +91696,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90978,9 +91712,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -90994,9 +91728,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91010,9 +91744,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91026,9 +91760,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91042,9 +91776,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91058,9 +91792,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91074,9 +91808,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91090,9 +91824,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91106,9 +91840,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91122,9 +91856,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91138,9 +91872,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91154,9 +91888,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91170,9 +91904,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91186,9 +91920,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91202,9 +91936,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91218,9 +91952,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91234,9 +91968,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91250,9 +91984,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91266,9 +92000,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91282,9 +92016,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91298,9 +92032,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91314,9 +92048,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91330,9 +92064,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91346,9 +92080,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91362,9 +92096,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91378,9 +92112,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91394,9 +92128,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91410,9 +92144,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91426,9 +92160,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91442,9 +92176,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91458,9 +92192,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91474,9 +92208,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91490,9 +92224,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91506,9 +92240,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91522,9 +92256,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91538,9 +92272,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91554,9 +92288,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91570,9 +92304,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91586,9 +92320,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91602,9 +92336,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91618,9 +92352,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91634,9 +92368,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91650,9 +92384,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91666,9 +92400,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91682,9 +92416,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91698,9 +92432,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91714,9 +92448,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91730,9 +92464,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91746,9 +92480,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91762,9 +92496,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91778,9 +92512,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91794,9 +92528,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91810,9 +92544,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91826,9 +92560,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91842,9 +92576,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91858,9 +92592,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91874,9 +92608,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91890,9 +92624,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91906,9 +92640,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91922,9 +92656,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91938,9 +92672,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91954,9 +92688,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91970,9 +92704,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -91986,9 +92720,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92002,9 +92736,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92018,9 +92752,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92034,9 +92768,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92050,9 +92784,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92066,9 +92800,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92082,9 +92816,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92098,9 +92832,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92114,9 +92848,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92130,9 +92864,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92146,9 +92880,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92162,9 +92896,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92178,9 +92912,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92194,9 +92928,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92210,9 +92944,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92226,9 +92960,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92242,9 +92976,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92258,9 +92992,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92274,9 +93008,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92290,9 +93024,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92306,9 +93040,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92322,9 +93056,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92338,9 +93072,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92354,9 +93088,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92370,9 +93104,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92386,9 +93120,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92402,9 +93136,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92418,9 +93152,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92434,9 +93168,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92450,9 +93184,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92466,9 +93200,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92482,9 +93216,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92498,9 +93232,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92514,9 +93248,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92530,9 +93264,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92546,9 +93280,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92562,9 +93296,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92578,9 +93312,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92594,9 +93328,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92610,9 +93344,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92626,9 +93360,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92642,9 +93376,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92658,9 +93392,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92674,9 +93408,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92690,9 +93424,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92706,9 +93440,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92722,9 +93456,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92738,9 +93472,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92754,9 +93488,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92770,9 +93504,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92786,9 +93520,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92802,9 +93536,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92818,9 +93552,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92834,9 +93568,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92850,9 +93584,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92866,9 +93600,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92882,9 +93616,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92898,9 +93632,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92914,9 +93648,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92930,9 +93664,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92946,9 +93680,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92962,9 +93696,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92978,9 +93712,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -92994,9 +93728,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93010,9 +93744,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93026,9 +93760,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93042,9 +93776,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93058,9 +93792,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93074,9 +93808,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93090,9 +93824,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93106,9 +93840,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93122,9 +93856,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93138,9 +93872,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93154,9 +93888,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93170,9 +93904,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93186,9 +93920,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93202,9 +93936,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1133",
@@ -93218,9 +93952,9 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 16,
+            "score": 15,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml"
         },
         {
             "techniqueID": "T1003",
@@ -93230,14 +93964,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93274,58 +94009,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93362,14 +94054,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93406,14 +94099,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93450,14 +94144,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93494,14 +94189,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93538,14 +94234,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93582,14 +94279,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93626,14 +94324,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93670,14 +94369,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93714,14 +94414,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93758,14 +94459,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93802,14 +94504,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93846,14 +94549,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93890,14 +94594,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93934,14 +94639,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -93978,14 +94684,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94022,14 +94729,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94066,14 +94774,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94110,14 +94819,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94154,14 +94864,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94198,14 +94909,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94242,14 +94954,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94286,14 +94999,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94330,14 +95044,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94374,14 +95089,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94418,14 +95134,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94462,14 +95179,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94506,14 +95224,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94550,14 +95269,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94594,14 +95314,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94638,14 +95359,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94682,14 +95404,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94726,14 +95449,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94770,14 +95494,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94814,14 +95539,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94858,14 +95584,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94902,58 +95629,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -94990,14 +95674,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95034,14 +95719,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95078,14 +95764,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95122,14 +95809,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95166,14 +95854,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95210,14 +95899,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95254,14 +95944,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95298,14 +95989,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95342,14 +96034,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95386,14 +96079,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95430,14 +96124,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95474,14 +96169,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95518,14 +96214,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95562,14 +96259,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95606,14 +96304,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95650,14 +96349,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95694,14 +96394,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95738,14 +96439,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95782,14 +96484,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95826,14 +96529,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95870,14 +96574,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95914,14 +96619,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -95958,14 +96664,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96002,14 +96709,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96046,14 +96754,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96090,14 +96799,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96134,14 +96844,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96178,14 +96889,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96222,14 +96934,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96266,14 +96979,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96310,14 +97024,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96354,14 +97069,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96398,14 +97114,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96442,14 +97159,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96486,14 +97204,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96530,58 +97249,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96618,14 +97294,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96662,14 +97339,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96706,14 +97384,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96750,14 +97429,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96794,14 +97474,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96838,14 +97519,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96882,14 +97564,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96926,14 +97609,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -96970,14 +97654,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97014,14 +97699,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97058,14 +97744,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97102,14 +97789,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97146,14 +97834,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97190,14 +97879,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97234,14 +97924,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97278,14 +97969,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97322,14 +98014,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97366,14 +98059,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97410,14 +98104,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97454,14 +98149,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97498,14 +98194,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97542,14 +98239,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97586,14 +98284,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97630,14 +98329,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97674,14 +98374,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97718,14 +98419,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97762,14 +98464,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97806,14 +98509,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97850,14 +98554,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97894,14 +98599,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97938,14 +98644,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -97982,14 +98689,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98026,14 +98734,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98070,14 +98779,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98114,14 +98824,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98158,58 +98869,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98246,14 +98914,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98290,14 +98959,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98334,14 +99004,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98378,14 +99049,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98422,14 +99094,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98466,14 +99139,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98510,14 +99184,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98554,14 +99229,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98598,14 +99274,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98642,14 +99319,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98686,14 +99364,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98730,14 +99409,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98774,14 +99454,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98818,14 +99499,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98862,14 +99544,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98906,14 +99589,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98950,14 +99634,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -98994,14 +99679,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99038,14 +99724,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99082,14 +99769,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99126,14 +99814,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99170,14 +99859,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99214,14 +99904,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99258,14 +99949,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99302,14 +99994,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99346,14 +100039,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99390,14 +100084,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99434,14 +100129,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99478,14 +100174,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99522,14 +100219,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99566,14 +100264,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99610,14 +100309,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99654,14 +100354,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99698,14 +100399,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99742,14 +100444,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99786,58 +100489,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99874,14 +100534,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99918,14 +100579,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -99962,14 +100624,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100006,14 +100669,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100050,14 +100714,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100094,14 +100759,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100138,14 +100804,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100182,14 +100849,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100226,14 +100894,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100270,14 +100939,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100314,14 +100984,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100358,14 +101029,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100402,14 +101074,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100446,14 +101119,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100490,14 +101164,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100534,14 +101209,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100578,14 +101254,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100622,14 +101299,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100666,14 +101344,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100710,14 +101389,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100754,14 +101434,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100798,14 +101479,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100842,14 +101524,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100886,14 +101569,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100930,14 +101614,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -100974,14 +101659,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101018,14 +101704,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101062,14 +101749,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101106,14 +101794,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101150,14 +101839,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101194,14 +101884,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101238,14 +101929,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101282,14 +101974,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101326,14 +102019,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101370,14 +102064,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101414,58 +102109,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101502,14 +102154,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101546,14 +102199,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101590,14 +102244,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101634,14 +102289,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101678,14 +102334,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101722,14 +102379,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101766,14 +102424,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101810,14 +102469,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101854,14 +102514,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101898,14 +102559,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101942,14 +102604,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -101986,14 +102649,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102030,14 +102694,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102074,14 +102739,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102118,14 +102784,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102162,14 +102829,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102206,14 +102874,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102250,14 +102919,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102294,14 +102964,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102338,14 +103009,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102382,14 +103054,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102426,14 +103099,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102470,14 +103144,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102514,14 +103189,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102558,14 +103234,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102602,14 +103279,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102646,14 +103324,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102690,14 +103369,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102734,14 +103414,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102778,14 +103459,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102822,14 +103504,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102866,14 +103549,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102910,14 +103594,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102954,14 +103639,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -102998,14 +103684,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103042,58 +103729,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103130,14 +103774,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103174,14 +103819,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103218,14 +103864,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103262,14 +103909,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103306,14 +103954,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103350,14 +103999,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103394,14 +104044,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103438,14 +104089,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103482,14 +104134,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103526,14 +104179,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103570,14 +104224,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103614,14 +104269,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103658,14 +104314,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103702,14 +104359,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103746,14 +104404,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103790,14 +104449,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103834,14 +104494,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103878,14 +104539,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103922,14 +104584,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -103966,14 +104629,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104010,14 +104674,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104054,14 +104719,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104098,14 +104764,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104142,14 +104809,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104186,14 +104854,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104230,14 +104899,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104274,14 +104944,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104318,14 +104989,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104362,14 +105034,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104406,14 +105079,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104450,14 +105124,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104494,14 +105169,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104538,14 +105214,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104582,14 +105259,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104626,14 +105304,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104670,58 +105349,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104758,14 +105394,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104802,14 +105439,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104846,14 +105484,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104890,14 +105529,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104934,14 +105574,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -104978,14 +105619,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105022,14 +105664,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105066,14 +105709,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105110,14 +105754,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105154,14 +105799,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105198,14 +105844,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105242,14 +105889,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105286,14 +105934,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105330,14 +105979,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105374,14 +106024,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105418,14 +106069,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105462,14 +106114,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105506,14 +106159,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105550,14 +106204,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105594,14 +106249,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105638,14 +106294,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105682,14 +106339,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105726,14 +106384,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105770,14 +106429,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105814,14 +106474,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105858,14 +106519,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105902,14 +106564,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105946,14 +106609,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -105990,14 +106654,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106034,14 +106699,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106078,14 +106744,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106122,14 +106789,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106166,14 +106834,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106210,14 +106879,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106254,14 +106924,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106298,58 +106969,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1543.003",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
-        },
-        {
-            "techniqueID": "T1036",
-            "score": 13,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
-        },
-        {
-            "techniqueID": "T1503",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.003",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1136.001",
-            "score": 14,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
-        },
-        {
-            "techniqueID": "T1041",
-            "score": 17,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003",
-            "score": 6,
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106386,14 +107014,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106430,14 +107059,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106474,14 +107104,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106518,14 +107149,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106562,14 +107194,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106606,14 +107239,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106650,14 +107284,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106694,14 +107329,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106738,14 +107374,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106782,14 +107419,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106826,14 +107464,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106870,14 +107509,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106914,14 +107554,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -106958,14 +107599,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107002,14 +107644,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107046,14 +107689,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107090,14 +107734,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107134,14 +107779,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107178,14 +107824,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107222,14 +107869,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107266,14 +107914,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107310,14 +107959,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107354,14 +108004,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107398,14 +108049,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107442,14 +108094,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107486,14 +108139,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107530,14 +108184,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107574,14 +108229,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107618,14 +108274,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107662,14 +108319,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107706,14 +108364,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107750,14 +108409,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107794,14 +108454,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107838,14 +108499,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107882,14 +108544,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107926,14 +108589,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -107970,14 +108634,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108014,14 +108679,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108058,14 +108724,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108102,14 +108769,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108146,14 +108814,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108190,14 +108859,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108234,14 +108904,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108278,14 +108949,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108322,14 +108994,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108366,14 +109039,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108410,14 +109084,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108454,14 +109129,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108498,14 +109174,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108542,14 +109219,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108586,14 +109264,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108630,14 +109309,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108674,14 +109354,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108718,14 +109399,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108762,14 +109444,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108806,14 +109489,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108850,14 +109534,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108894,14 +109579,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108938,14 +109624,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -108982,14 +109669,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109026,14 +109714,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109070,14 +109759,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109114,14 +109804,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109158,14 +109849,60 @@
         },
         {
             "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
             "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1543.003",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109202,14 +109939,60 @@
         },
         {
             "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
             "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1543.003",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109246,14 +110029,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109290,14 +110074,15 @@
         },
         {
             "techniqueID": "T1087.001",
-            "score": 17,
-            "showSubtechniques": false
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1543.003",
-            "score": 14,
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109334,14 +110119,60 @@
         },
         {
             "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
             "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1543.003",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
             "techniqueID": "T1036",
@@ -109371,168 +110202,273 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.011",
-            "score": 7,
+            "techniqueID": "T1003",
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1087.002",
-            "score": 15,
+            "techniqueID": "T1087.001",
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1021.002",
-            "score": 11,
+            "techniqueID": "T1543.003",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1505.003",
-            "score": 14,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1085",
-            "score": 16,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.002",
-            "score": 16,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1073",
-            "score": 16,
+            "techniqueID": "T1136.001",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1100",
-            "score": 16,
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1046",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1574.002",
-            "score": 16,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.011",
-            "score": 7,
+            "techniqueID": "T1003",
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1087.002",
-            "score": 15,
+            "techniqueID": "T1087.001",
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1021.002",
-            "score": 11,
+            "techniqueID": "T1543.003",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1505.003",
-            "score": 14,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1085",
-            "score": 16,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.002",
-            "score": 16,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1073",
-            "score": 16,
+            "techniqueID": "T1136.001",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1100",
-            "score": 16,
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1046",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1574.002",
-            "score": 16,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.011",
-            "score": 7,
+            "techniqueID": "T1003",
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1087.002",
-            "score": 15,
+            "techniqueID": "T1087.001",
+            "score": 12,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1021.002",
-            "score": 11,
+            "techniqueID": "T1543.003",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
         },
         {
-            "techniqueID": "T1505.003",
-            "score": 14,
+            "techniqueID": "T1036",
+            "score": 13,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
         },
         {
-            "techniqueID": "T1085",
-            "score": 16,
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1136.002",
-            "score": 16,
+            "techniqueID": "T1555.003",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1073",
-            "score": 16,
+            "techniqueID": "T1136.001",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+        },
+        {
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1100",
-            "score": 16,
+            "techniqueID": "T1003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1087.001",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1543.003",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml"
+        },
+        {
+            "techniqueID": "T1036",
+            "score": 13,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml"
+        },
+        {
+            "techniqueID": "T1503",
+            "score": 17,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1046",
+            "techniqueID": "T1555.003",
+            "score": 17,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1136.001",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
-            "techniqueID": "T1574.002",
-            "score": 16,
+            "techniqueID": "T1041",
+            "score": 17,
             "showSubtechniques": false
         },
         {
@@ -109543,9 +110479,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109598,9 +110534,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109653,9 +110589,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109708,9 +110644,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109763,9 +110699,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109818,9 +110754,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109873,9 +110809,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109928,9 +110864,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -109983,9 +110919,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110038,9 +110974,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110093,9 +111029,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110148,9 +111084,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110203,9 +111139,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110258,9 +111194,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110313,9 +111249,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110368,9 +111304,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110423,9 +111359,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110478,9 +111414,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110533,9 +111469,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110588,9 +111524,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110643,9 +111579,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110698,9 +111634,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110753,9 +111689,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110808,9 +111744,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110863,9 +111799,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110918,9 +111854,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -110973,9 +111909,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111028,9 +111964,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111083,9 +112019,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111138,9 +112074,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111193,9 +112129,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111248,9 +112184,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111303,9 +112239,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111358,9 +112294,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111413,9 +112349,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111468,9 +112404,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111523,9 +112459,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111578,9 +112514,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111633,9 +112569,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111688,9 +112624,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111743,9 +112679,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111798,9 +112734,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111853,9 +112789,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111908,9 +112844,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -111963,9 +112899,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112018,9 +112954,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112073,9 +113009,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112128,9 +113064,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112183,9 +113119,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112238,9 +113174,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112293,9 +113229,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112348,9 +113284,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112403,9 +113339,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112458,9 +113394,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112513,9 +113449,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112568,9 +113504,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112623,9 +113559,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112678,9 +113614,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112733,9 +113669,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112788,9 +113724,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112843,9 +113779,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112898,9 +113834,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -112953,9 +113889,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113008,9 +113944,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113063,9 +113999,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113118,9 +114054,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113173,9 +114109,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113228,9 +114164,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113283,9 +114219,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113338,9 +114274,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113393,9 +114329,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113448,9 +114384,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113503,9 +114439,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113558,9 +114494,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113613,9 +114549,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113668,9 +114604,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113723,9 +114659,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113778,9 +114714,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113833,9 +114769,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113888,9 +114824,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113943,9 +114879,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -113998,9 +114934,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114053,9 +114989,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114108,9 +115044,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114163,9 +115099,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114218,9 +115154,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114273,9 +115209,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114328,9 +115264,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114383,9 +115319,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114438,9 +115374,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114493,9 +115429,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114548,9 +115484,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114603,9 +115539,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114658,9 +115594,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114713,9 +115649,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114768,9 +115704,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114823,9 +115759,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114878,9 +115814,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114933,9 +115869,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -114988,9 +115924,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115043,9 +115979,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115098,9 +116034,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115153,9 +116089,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115208,9 +116144,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115263,9 +116199,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115318,9 +116254,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115373,9 +116309,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115428,9 +116364,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115483,9 +116419,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115538,9 +116474,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115593,9 +116529,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115648,9 +116584,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115703,9 +116639,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115758,9 +116694,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115813,9 +116749,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115868,9 +116804,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115923,9 +116859,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -115978,9 +116914,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116033,9 +116969,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116088,9 +117024,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116143,9 +117079,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116198,9 +117134,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116253,9 +117189,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116308,9 +117244,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116363,9 +117299,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116418,9 +117354,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116473,9 +117409,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116528,9 +117464,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116583,9 +117519,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116638,9 +117574,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116693,9 +117629,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116748,9 +117684,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116803,9 +117739,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116858,9 +117794,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116913,9 +117849,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -116968,9 +117904,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117023,9 +117959,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117078,9 +118014,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117133,9 +118069,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117188,9 +118124,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117243,9 +118179,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117298,9 +118234,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117353,9 +118289,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117408,9 +118344,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117463,9 +118399,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117518,9 +118454,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117573,9 +118509,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117628,9 +118564,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117683,9 +118619,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117738,9 +118674,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117793,9 +118729,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117848,9 +118784,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117903,9 +118839,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -117958,9 +118894,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118013,9 +118949,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118068,9 +119004,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118123,9 +119059,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118178,9 +119114,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118233,9 +119169,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118288,9 +119224,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118343,9 +119279,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118398,9 +119334,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118453,9 +119389,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118508,9 +119444,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118563,9 +119499,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118618,9 +119554,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118673,9 +119609,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118728,9 +119664,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118783,9 +119719,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118838,9 +119774,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118893,9 +119829,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -118948,9 +119884,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119003,9 +119939,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119058,9 +119994,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119113,9 +120049,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119168,9 +120104,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119223,9 +120159,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119278,9 +120214,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119333,9 +120269,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119388,9 +120324,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119443,9 +120379,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119498,9 +120434,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119553,9 +120489,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119608,9 +120544,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119663,9 +120599,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119718,9 +120654,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119773,9 +120709,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119828,9 +120764,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119883,9 +120819,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119938,9 +120874,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -119993,9 +120929,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120048,9 +120984,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120103,9 +121039,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120158,9 +121094,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120213,9 +121149,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120268,9 +121204,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120323,9 +121259,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120378,9 +121314,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120433,9 +121369,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120488,9 +121424,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120543,9 +121479,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120598,9 +121534,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120653,9 +121589,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120708,9 +121644,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120763,9 +121699,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120818,9 +121754,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120873,9 +121809,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120928,9 +121864,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -120983,9 +121919,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121038,9 +121974,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121093,9 +122029,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121148,9 +122084,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121203,9 +122139,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121258,9 +122194,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121313,9 +122249,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121368,9 +122304,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121423,9 +122359,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121478,9 +122414,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121533,9 +122469,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121588,9 +122524,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121643,9 +122579,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121698,9 +122634,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121753,9 +122689,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121808,9 +122744,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121863,9 +122799,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121918,9 +122854,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -121973,9 +122909,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122028,9 +122964,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122083,9 +123019,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122138,9 +123074,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122193,9 +123129,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122248,9 +123184,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122303,9 +123239,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122358,9 +123294,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122413,9 +123349,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122468,9 +123404,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122523,9 +123459,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122578,9 +123514,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122633,9 +123569,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122688,9 +123624,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122743,9 +123679,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122798,9 +123734,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122853,9 +123789,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122908,9 +123844,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -122963,9 +123899,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123018,9 +123954,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123073,9 +124009,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123128,9 +124064,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123183,9 +124119,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123238,9 +124174,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123293,9 +124229,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123348,9 +124284,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123403,9 +124339,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123458,9 +124394,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123513,9 +124449,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123568,9 +124504,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123623,9 +124559,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123678,9 +124614,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123733,9 +124669,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123788,9 +124724,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123843,9 +124779,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123898,9 +124834,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -123953,9 +124889,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124008,9 +124944,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124063,9 +124999,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124118,9 +125054,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124173,9 +125109,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124228,9 +125164,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124283,9 +125219,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124338,9 +125274,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124393,9 +125329,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124448,9 +125384,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124503,9 +125439,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124558,9 +125494,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124613,9 +125549,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124668,9 +125604,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124723,9 +125659,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124778,9 +125714,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124833,9 +125769,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124888,9 +125824,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124943,9 +125879,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -124998,9 +125934,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125053,9 +125989,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125108,9 +126044,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125163,9 +126099,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125218,9 +126154,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125273,9 +126209,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125328,9 +126264,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125383,9 +126319,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125438,9 +126374,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125493,9 +126429,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125548,9 +126484,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125603,9 +126539,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125658,9 +126594,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125713,9 +126649,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125768,9 +126704,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125823,9 +126759,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125878,9 +126814,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125933,9 +126869,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -125988,9 +126924,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126043,9 +126979,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126098,9 +127034,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126153,9 +127089,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126208,9 +127144,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126263,9 +127199,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126318,9 +127254,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126373,9 +127309,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126428,9 +127364,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126483,9 +127419,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126538,9 +127474,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126593,9 +127529,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126648,9 +127584,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126703,9 +127639,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126758,9 +127694,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126813,9 +127749,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126868,9 +127804,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126923,9 +127859,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -126978,9 +127914,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127033,9 +127969,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127088,9 +128024,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127143,9 +128079,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127198,9 +128134,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127253,9 +128189,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127308,9 +128244,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127363,9 +128299,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127418,9 +128354,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127473,9 +128409,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127528,9 +128464,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127583,9 +128519,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127638,9 +128574,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127693,9 +128629,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127748,9 +128684,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127803,9 +128739,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127858,9 +128794,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127913,9 +128849,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -127968,9 +128904,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128023,9 +128959,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128078,9 +129014,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128133,9 +129069,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128188,9 +129124,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128243,9 +129179,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128298,9 +129234,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128353,9 +129289,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128408,9 +129344,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128463,9 +129399,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128518,9 +129454,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128573,9 +129509,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128628,9 +129564,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128683,9 +129619,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128738,9 +129674,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128793,9 +129729,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128848,9 +129784,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128903,9 +129839,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -128958,9 +129894,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129013,9 +129949,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129068,9 +130004,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129123,9 +130059,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129178,9 +130114,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129233,9 +130169,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129288,9 +130224,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129343,9 +130279,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129398,9 +130334,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129453,9 +130389,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129508,9 +130444,9 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 15,
+            "score": 10,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1021.002",
@@ -129556,87 +130492,252 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1063",
-            "score": 15,
+            "techniqueID": "T1218.011",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
+        },
+        {
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1119",
-            "score": 15,
+            "techniqueID": "T1136.002",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1190",
+            "techniqueID": "T1073",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1100",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1046",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1555",
-            "score": 12,
+            "techniqueID": "T1574.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
         },
         {
-            "techniqueID": "T1583.001",
-            "score": 15,
-            "showSubtechniques": false
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1518.001",
-            "score": 15,
-            "showSubtechniques": false
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
         },
         {
-            "techniqueID": "T1043",
-            "score": 15,
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.001",
-            "score": 15,
+            "techniqueID": "T1136.002",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1063",
-            "score": 15,
+            "techniqueID": "T1073",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1119",
-            "score": 15,
+            "techniqueID": "T1100",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1190",
+            "techniqueID": "T1046",
             "score": 14,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1555",
-            "score": 12,
+            "techniqueID": "T1574.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.011",
+            "score": 7,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml"
         },
         {
-            "techniqueID": "T1583.001",
-            "score": 15,
+            "techniqueID": "T1087.002",
+            "score": 10,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1021.002",
+            "score": 11,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml"
+        },
+        {
+            "techniqueID": "T1505.003",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml"
+        },
+        {
+            "techniqueID": "T1085",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1518.001",
-            "score": 15,
+            "techniqueID": "T1136.002",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1043",
-            "score": 15,
+            "techniqueID": "T1073",
+            "score": 16,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.001",
-            "score": 15,
+            "techniqueID": "T1100",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1046",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1574.002",
+            "score": 16,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1063",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1119",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1190",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1555",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml"
+        },
+        {
+            "techniqueID": "T1583.001",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1518.001",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1043",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.001",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1063",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1119",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1190",
+            "score": 14,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml"
+        },
+        {
+            "techniqueID": "T1555",
+            "score": 12,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml"
+        },
+        {
+            "techniqueID": "T1583.001",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1518.001",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1043",
+            "score": 15,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.001",
+            "score": 15,
             "showSubtechniques": false
         },
         {
@@ -164466,9 +165567,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164521,9 +165622,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164576,9 +165677,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164631,9 +165732,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164686,9 +165787,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164741,9 +165842,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164796,9 +165897,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164851,9 +165952,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164906,9 +166007,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -164961,9 +166062,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165016,9 +166117,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165071,9 +166172,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165126,9 +166227,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165181,9 +166282,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165236,9 +166337,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165291,9 +166392,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165346,9 +166447,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165401,9 +166502,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165456,9 +166557,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165511,9 +166612,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165566,9 +166667,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165621,9 +166722,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165676,9 +166777,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165731,9 +166832,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165786,9 +166887,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165841,9 +166942,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165896,9 +166997,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -165951,9 +167052,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166006,9 +167107,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166061,9 +167162,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166116,9 +167217,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166171,9 +167272,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166226,9 +167327,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166281,9 +167382,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166336,9 +167437,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166391,9 +167492,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166446,9 +167547,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166501,9 +167602,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166556,9 +167657,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166611,9 +167712,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166666,9 +167767,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166721,9 +167822,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166776,9 +167877,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166831,9 +167932,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166886,9 +167987,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166941,9 +168042,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -166996,9 +168097,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167051,9 +168152,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167106,9 +168207,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167161,9 +168262,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167216,9 +168317,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167271,9 +168372,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167326,9 +168427,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167381,9 +168482,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167436,9 +168537,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167491,9 +168592,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167546,9 +168647,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167601,9 +168702,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167656,9 +168757,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167711,9 +168812,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167766,9 +168867,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167821,9 +168922,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167876,9 +168977,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167931,9 +169032,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -167986,9 +169087,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168041,9 +169142,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168096,9 +169197,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168151,9 +169252,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168206,9 +169307,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168261,9 +169362,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168316,9 +169417,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168371,9 +169472,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168426,9 +169527,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168481,9 +169582,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168536,9 +169637,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168591,9 +169692,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168646,9 +169747,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168701,9 +169802,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168756,9 +169857,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168811,9 +169912,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168866,9 +169967,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168921,9 +170022,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -168976,9 +170077,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169031,9 +170132,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169086,9 +170187,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169141,9 +170242,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169196,9 +170297,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169251,9 +170352,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169306,9 +170407,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169361,9 +170462,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169416,9 +170517,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169471,9 +170572,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169526,9 +170627,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169581,9 +170682,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169636,9 +170737,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169691,9 +170792,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169746,9 +170847,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169801,9 +170902,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169856,9 +170957,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169911,9 +171012,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -169966,9 +171067,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170021,9 +171122,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170076,9 +171177,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170131,9 +171232,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170186,9 +171287,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170241,9 +171342,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170296,9 +171397,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170351,9 +171452,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170406,9 +171507,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170461,9 +171562,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170516,9 +171617,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170571,9 +171672,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170626,9 +171727,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170681,9 +171782,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170736,9 +171837,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170791,9 +171892,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170846,9 +171947,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170901,9 +172002,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -170956,9 +172057,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171011,9 +172112,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171066,9 +172167,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171121,9 +172222,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171176,9 +172277,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171231,9 +172332,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171286,9 +172387,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171341,9 +172442,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171396,9 +172497,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171451,9 +172552,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171506,9 +172607,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171561,9 +172662,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171616,9 +172717,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171671,9 +172772,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171726,9 +172827,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171781,9 +172882,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171836,9 +172937,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171891,9 +172992,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -171946,9 +173047,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172001,9 +173102,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172056,9 +173157,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172111,9 +173212,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172166,9 +173267,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172221,9 +173322,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172276,9 +173377,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172331,9 +173432,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172386,9 +173487,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172441,9 +173542,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172496,9 +173597,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172551,9 +173652,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172606,9 +173707,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172661,9 +173762,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172716,9 +173817,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172771,9 +173872,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172826,9 +173927,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172881,9 +173982,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172936,9 +174037,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -172991,9 +174092,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173046,9 +174147,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173101,9 +174202,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173156,9 +174257,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173211,9 +174312,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173266,9 +174367,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173321,9 +174422,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173376,9 +174477,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173431,9 +174532,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173486,9 +174587,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173541,9 +174642,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173596,9 +174697,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173651,9 +174752,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173706,9 +174807,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173761,9 +174862,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173816,9 +174917,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173871,9 +174972,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173926,9 +175027,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -173981,9 +175082,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174036,9 +175137,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174091,9 +175192,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174146,9 +175247,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174201,9 +175302,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174256,9 +175357,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174311,9 +175412,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174366,9 +175467,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174421,9 +175522,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174476,9 +175577,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174531,9 +175632,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174586,9 +175687,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174641,9 +175742,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174696,9 +175797,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174751,9 +175852,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174806,9 +175907,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174861,9 +175962,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174916,9 +176017,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -174971,9 +176072,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175026,9 +176127,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175081,9 +176182,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175136,9 +176237,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175191,9 +176292,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175246,9 +176347,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175301,9 +176402,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175356,9 +176457,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175411,9 +176512,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175466,9 +176567,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175521,9 +176622,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175576,9 +176677,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175631,9 +176732,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175686,9 +176787,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175741,9 +176842,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175796,9 +176897,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175851,9 +176952,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175906,9 +177007,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -175961,9 +177062,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176016,9 +177117,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176071,9 +177172,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176126,9 +177227,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176181,9 +177282,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176236,9 +177337,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176291,9 +177392,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176346,9 +177447,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176401,9 +177502,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176456,9 +177557,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176511,9 +177612,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176566,9 +177667,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176621,9 +177722,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176676,9 +177777,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176731,9 +177832,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176786,9 +177887,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176841,9 +177942,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176896,9 +177997,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -176951,9 +178052,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177006,9 +178107,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177061,9 +178162,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177116,9 +178217,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177171,9 +178272,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177226,9 +178327,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177281,9 +178382,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177336,9 +178437,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177391,9 +178492,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177446,9 +178547,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177501,9 +178602,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177556,9 +178657,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177611,9 +178712,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177666,9 +178767,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177721,9 +178822,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177776,9 +178877,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177831,9 +178932,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177886,9 +178987,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177941,9 +179042,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -177996,9 +179097,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178051,9 +179152,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178106,9 +179207,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178161,9 +179262,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178216,9 +179317,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178271,9 +179372,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178326,9 +179427,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178381,9 +179482,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178436,9 +179537,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178491,9 +179592,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178546,9 +179647,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178601,9 +179702,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178656,9 +179757,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178711,9 +179812,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178766,9 +179867,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178821,9 +179922,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178876,9 +179977,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178931,9 +180032,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -178986,9 +180087,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179041,9 +180142,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179096,9 +180197,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179151,9 +180252,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179206,9 +180307,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179261,9 +180362,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179316,9 +180417,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179371,9 +180472,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179426,9 +180527,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179481,9 +180582,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179536,9 +180637,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179591,9 +180692,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179646,9 +180747,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179701,9 +180802,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179756,9 +180857,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179811,9 +180912,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179866,9 +180967,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179921,9 +181022,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -179976,9 +181077,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180031,9 +181132,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180086,9 +181187,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180141,9 +181242,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180196,9 +181297,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180251,9 +181352,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180306,9 +181407,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180361,9 +181462,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180416,9 +181517,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180471,9 +181572,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180526,9 +181627,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180581,9 +181682,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180636,9 +181737,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180691,9 +181792,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180746,9 +181847,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180801,9 +181902,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180856,9 +181957,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180911,9 +182012,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -180966,9 +182067,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181021,9 +182122,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181076,9 +182177,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181131,9 +182232,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181186,9 +182287,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181241,9 +182342,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181296,9 +182397,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181351,9 +182452,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181406,9 +182507,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181461,9 +182562,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181516,9 +182617,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181571,9 +182672,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181626,9 +182727,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181681,9 +182782,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181736,9 +182837,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181791,9 +182892,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181846,9 +182947,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181901,9 +183002,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -181956,9 +183057,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182011,9 +183112,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182066,9 +183167,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182121,9 +183222,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182176,9 +183277,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182231,9 +183332,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182286,9 +183387,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182341,9 +183442,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182396,9 +183497,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182451,9 +183552,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182506,9 +183607,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182561,9 +183662,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182616,9 +183717,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182671,9 +183772,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182726,9 +183827,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182781,9 +183882,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182836,9 +183937,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182891,9 +183992,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -182946,9 +184047,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183001,9 +184102,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183056,9 +184157,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183111,9 +184212,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183166,9 +184267,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183221,9 +184322,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183276,9 +184377,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183331,9 +184432,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183386,9 +184487,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183441,9 +184542,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183496,9 +184597,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183551,9 +184652,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183606,9 +184707,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183661,9 +184762,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183716,9 +184817,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183771,9 +184872,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183826,9 +184927,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183881,9 +184982,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183936,9 +185037,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -183991,9 +185092,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184046,9 +185147,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184101,9 +185202,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184156,9 +185257,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184211,9 +185312,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184266,9 +185367,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184321,9 +185422,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184376,9 +185477,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184431,9 +185532,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184486,9 +185587,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184541,9 +185642,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -184596,9 +185697,9 @@
         },
         {
             "techniqueID": "T1569.002",
-            "score": 9,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml"
         },
         {
             "techniqueID": "T1035",
@@ -237884,9 +238985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -237964,9 +239065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238044,9 +239145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238124,9 +239225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238204,9 +239305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238284,9 +239385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238364,9 +239465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238444,9 +239545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238524,9 +239625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238604,9 +239705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238684,9 +239785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238764,9 +239865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238844,9 +239945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -238924,9 +240025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239004,9 +240105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239084,9 +240185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239164,9 +240265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239244,9 +240345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239324,9 +240425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239404,9 +240505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239484,9 +240585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239564,9 +240665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239644,9 +240745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239724,9 +240825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239804,9 +240905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239884,9 +240985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -239964,9 +241065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240044,9 +241145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240124,9 +241225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240204,9 +241305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240284,9 +241385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240364,9 +241465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240444,9 +241545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240524,9 +241625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240604,9 +241705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240684,9 +241785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240764,9 +241865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240844,9 +241945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -240924,9 +242025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241004,9 +242105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241084,9 +242185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241164,9 +242265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241244,9 +242345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241324,9 +242425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241404,9 +242505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241484,9 +242585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241564,9 +242665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241644,9 +242745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241724,9 +242825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241804,9 +242905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241884,9 +242985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -241964,9 +243065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242044,9 +243145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242124,9 +243225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242204,9 +243305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242284,9 +243385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242364,9 +243465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242444,9 +243545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242524,9 +243625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242604,9 +243705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242684,9 +243785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242764,9 +243865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242844,9 +243945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -242924,9 +244025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243004,9 +244105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243084,9 +244185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243164,9 +244265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243244,9 +244345,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243324,9 +244505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243404,9 +244585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243484,9 +244665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243564,9 +244745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243644,9 +244825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243724,9 +244905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243804,9 +244985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243884,9 +245065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -243964,9 +245145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244044,9 +245225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244124,9 +245305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244204,9 +245385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244284,9 +245465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244364,9 +245545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244444,9 +245625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244524,9 +245705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244604,9 +245785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244684,9 +245865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244764,9 +245945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244844,9 +246025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -244924,9 +246105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245004,9 +246185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245084,9 +246265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245164,9 +246345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245244,9 +246425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245324,9 +246505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245404,9 +246585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245484,9 +246665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245564,9 +246745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245644,9 +246825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245724,9 +246905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245804,9 +246985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245884,9 +247065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -245964,9 +247145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246044,9 +247225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246124,9 +247305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246204,9 +247385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246284,9 +247465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246364,9 +247545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246444,9 +247625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246524,9 +247705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246604,9 +247785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246684,9 +247865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246764,9 +247945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246844,9 +248025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -246924,9 +248105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247004,9 +248185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247084,9 +248265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247164,9 +248345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247244,9 +248425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247324,9 +248505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247404,9 +248585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247484,9 +248665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247564,9 +248745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247644,9 +248825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247724,9 +248905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247804,9 +248985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247884,9 +249065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -247964,9 +249145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248044,9 +249225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248124,9 +249305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248204,9 +249385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248284,9 +249465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248364,9 +249545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248444,9 +249625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248524,9 +249705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248604,9 +249785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248684,9 +249865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248764,9 +249945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248844,9 +250025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -248924,9 +250105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249004,9 +250185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249084,9 +250265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249164,9 +250345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249244,9 +250425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249324,9 +250505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249404,9 +250585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249484,9 +250665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249564,9 +250745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249644,9 +250825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249724,9 +250905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249804,9 +250985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249884,9 +251065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -249964,9 +251145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250044,9 +251225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250124,9 +251305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250204,9 +251385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250284,9 +251465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250364,9 +251545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250444,9 +251625,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250524,9 +251785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250604,9 +251865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250684,9 +251945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250764,9 +252025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250844,9 +252105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -250924,9 +252185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251004,9 +252265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251084,9 +252345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251164,9 +252425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251244,9 +252505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251324,9 +252585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251404,9 +252665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251484,9 +252745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251564,9 +252825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251644,9 +252905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251724,9 +252985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251804,9 +253065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251884,9 +253145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -251964,9 +253225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252044,9 +253305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252124,9 +253385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252204,9 +253465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252284,9 +253545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252364,9 +253625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252444,9 +253705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252524,9 +253785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252604,9 +253865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252684,9 +253945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252764,9 +254025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252844,9 +254105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -252924,9 +254185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253004,9 +254265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253084,9 +254345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253164,9 +254425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253244,9 +254505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253324,9 +254585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253404,9 +254665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253484,9 +254745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253564,9 +254825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253644,9 +254905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253724,9 +254985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253804,9 +255065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253884,9 +255145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -253964,9 +255225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254044,9 +255305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254124,9 +255385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254204,9 +255465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254284,9 +255545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254364,9 +255625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254444,9 +255705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254524,9 +255785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254604,9 +255865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254684,9 +255945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254764,9 +256025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254844,9 +256105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -254924,9 +256185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255004,9 +256265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255084,9 +256345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255164,9 +256425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255244,9 +256505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255324,9 +256585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255404,9 +256665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255484,9 +256745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255564,9 +256825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255644,9 +256905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255724,9 +256985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255804,9 +257065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255884,9 +257145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -255964,9 +257225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256044,9 +257305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256124,9 +257385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256204,9 +257465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256284,9 +257545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256364,9 +257625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256444,9 +257705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256524,9 +257785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256604,9 +257865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256684,9 +257945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256764,9 +258025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256844,9 +258105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -256924,9 +258185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257004,9 +258265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257084,9 +258345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257164,9 +258425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257244,9 +258505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257324,9 +258585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257404,9 +258665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257484,9 +258745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257564,9 +258825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257644,9 +258905,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257724,9 +259065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257804,9 +259145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257884,9 +259225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -257964,9 +259305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258044,9 +259385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258124,9 +259465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258204,9 +259545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258284,9 +259625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258364,9 +259705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258444,9 +259785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258524,9 +259865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258604,9 +259945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258684,9 +260025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258764,9 +260105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258844,9 +260185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -258924,9 +260265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259004,9 +260345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259084,9 +260425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259164,9 +260505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259244,9 +260585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259324,9 +260665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259404,9 +260745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259484,9 +260825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259564,9 +260905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259644,9 +260985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259724,9 +261065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259804,9 +261145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259884,9 +261225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -259964,9 +261305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260044,9 +261385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260124,9 +261465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260204,9 +261545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260284,9 +261625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260364,9 +261705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260444,9 +261785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260524,9 +261865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260604,9 +261945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260684,9 +262025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260764,9 +262105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260844,9 +262185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -260924,9 +262265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261004,9 +262345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261084,9 +262425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261164,9 +262505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261244,9 +262585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261324,9 +262665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261404,9 +262745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261484,9 +262825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261564,9 +262905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261644,9 +262985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261724,9 +263065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261804,9 +263145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261884,9 +263225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -261964,9 +263305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262044,9 +263385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262124,9 +263465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262204,9 +263545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262284,9 +263625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262364,9 +263705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262444,9 +263785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262524,9 +263865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262604,9 +263945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262684,9 +264025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262764,9 +264105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262844,9 +264185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -262924,9 +264265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263004,9 +264345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263084,9 +264425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263164,9 +264505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263244,9 +264585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263324,9 +264665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263404,9 +264745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263484,9 +264825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263564,9 +264905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263644,9 +264985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263724,9 +265065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263804,9 +265145,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263884,9 +265225,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -263964,9 +265305,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264044,9 +265385,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264124,9 +265465,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264204,9 +265545,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264284,9 +265625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264364,9 +265705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264444,9 +265785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264524,9 +265865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264604,9 +265945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264684,9 +266025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264764,9 +266105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264844,9 +266185,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -264924,9 +266345,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265004,9 +266425,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265084,9 +266505,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265164,9 +266585,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265244,9 +266665,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265324,9 +266745,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265404,9 +266825,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265484,9 +266905,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265564,9 +266985,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265644,9 +267065,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265724,9 +267145,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265804,9 +267305,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265884,9 +267465,89 @@
         },
         {
             "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+        },
+        {
+            "techniqueID": "T1048.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+        },
+        {
+            "techniqueID": "T1078.003",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+        },
+        {
+            "techniqueID": "T1066",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1137",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.004",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074.002",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1009",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.004",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
+        },
+        {
+            "techniqueID": "T1027.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
+        },
+        {
+            "techniqueID": "T1552.001",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.005",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1065",
+            "score": 8,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -265964,9 +267625,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266044,9 +267705,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266124,9 +267785,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266204,9 +267865,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266284,9 +267945,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266364,9 +268025,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266444,9 +268105,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266524,9 +268185,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266604,9 +268265,9 @@
         },
         {
             "techniqueID": "T1003.003",
-            "score": 2,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -266621,564 +268282,310 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
         },
         {
-            "techniqueID": "T1066",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1137",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.004",
-            "score": 8,
+            "techniqueID": "T1069",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.002",
-            "score": 8,
-            "showSubtechniques": false
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
         },
         {
-            "techniqueID": "T1009",
-            "score": 8,
+            "techniqueID": "T1071",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
+            "techniqueID": "T1547.009",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1070",
+            "techniqueID": "T1546.003",
             "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1027.005",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1023",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
+            "techniqueID": "T1590",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1048.003",
-            "score": 2,
+            "techniqueID": "T1098",
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1195.002",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1137",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074.002",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1009",
-            "score": 8,
+            "techniqueID": "T1570",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
+            "techniqueID": "T1075",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1070",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
+            "techniqueID": "T1027.003",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.005",
-            "score": 8,
+            "techniqueID": "T1194",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1221",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
+            "techniqueID": "T1134",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1048.003",
-            "score": 2,
+            "techniqueID": "T1550.002",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1084",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1137",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074.002",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1009",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
+            "techniqueID": "T1001.002",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1070",
+            "techniqueID": "T1566.003",
             "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1027.005",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1069",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
-        },
-        {
-            "techniqueID": "T1048.003",
+            "techniqueID": "T1003.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1071",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1137",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.004",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.002",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1009",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.004",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
+            "techniqueID": "T1547.009",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1070",
+            "techniqueID": "T1546.003",
             "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1027.005",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1023",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
+            "techniqueID": "T1590",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1048.003",
-            "score": 2,
+            "techniqueID": "T1098",
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1195.002",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.004",
-            "score": 8,
+            "techniqueID": "T1570",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1137",
-            "score": 8,
+            "techniqueID": "T1075",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.004",
-            "score": 8,
+            "techniqueID": "T1027.003",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.002",
-            "score": 8,
+            "techniqueID": "T1194",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1009",
-            "score": 8,
+            "techniqueID": "T1221",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
+            "techniqueID": "T1134",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1070",
-            "score": 6,
+            "techniqueID": "T1550.002",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {
-            "techniqueID": "T1027.005",
-            "score": 8,
+            "techniqueID": "T1084",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1001.002",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
-        },
-        {
-            "techniqueID": "T1048.003",
-            "score": 2,
+            "techniqueID": "T1566.003",
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1069",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.004",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1137",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.004",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.002",
-            "score": 8,
-            "showSubtechniques": false
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
         },
         {
-            "techniqueID": "T1009",
-            "score": 8,
+            "techniqueID": "T1071",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
+            "techniqueID": "T1547.009",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1070",
+            "techniqueID": "T1546.003",
             "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1027.005",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1023",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
+            "techniqueID": "T1590",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1048.003",
-            "score": 2,
+            "techniqueID": "T1098",
+            "score": -8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1078.003",
+            "techniqueID": "T1195.002",
             "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
-        },
-        {
-            "techniqueID": "T1066",
-            "score": 8,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.004",
-            "score": 8,
+            "techniqueID": "T1570",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1137",
-            "score": 8,
+            "techniqueID": "T1075",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.004",
-            "score": 8,
+            "techniqueID": "T1027.003",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074.002",
-            "score": 8,
+            "techniqueID": "T1194",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1009",
-            "score": 8,
+            "techniqueID": "T1221",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.004",
-            "score": 6,
+            "techniqueID": "T1134",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml"
-        },
-        {
-            "techniqueID": "T1027.001",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1070",
-            "score": 6,
+            "techniqueID": "T1550.002",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml"
-        },
-        {
-            "techniqueID": "T1552.001",
-            "score": 8,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
         },
         {
-            "techniqueID": "T1027.005",
-            "score": 8,
+            "techniqueID": "T1084",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1065",
-            "score": 8,
+            "techniqueID": "T1001.002",
+            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml"
-        },
-        {
-            "techniqueID": "T1048.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml"
-        },
-        {
-            "techniqueID": "T1078.003",
-            "score": 7,
+            "techniqueID": "T1566.003",
+            "score": 6,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
         },
         {
             "techniqueID": "T1069",
@@ -304309,310 +305716,226 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
         },
         {
-            "techniqueID": "T1069",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1120",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1087",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1566.003",
-            "score": 6,
+            "techniqueID": "T1020",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1069",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 2,
+            "techniqueID": "T1039",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1158",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1038",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
-            "score": 6,
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1023",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1087",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1090.001",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+            "showSubtechniques": false
         },
         {
             "techniqueID": "T1037",
@@ -345130,225 +346453,133 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1120",
-            "score": 6,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.002",
-            "score": 6,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1038",
-            "score": 6,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550",
-            "score": 6,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.002",
-            "score": 6,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.003",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml"
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.008",
+            "techniqueID": "T1188",
             "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1020",
+            "techniqueID": "T1210",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml"
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1039",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1564.001",
+            "techniqueID": "T1566",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1120",
-            "score": 6,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.002",
-            "score": 6,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1038",
-            "score": 6,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550",
-            "score": 6,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.002",
-            "score": 6,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.003",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml"
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.008",
+            "techniqueID": "T1598",
             "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml"
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1095",
-            "score": 6,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1158",
-            "score": 6,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1564.001",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1090.001",
-            "score": 6,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
@@ -345358,8 +346589,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -345404,8 +346636,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -345486,8 +346719,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -345532,8 +346766,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -345614,8 +346849,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -345660,8 +346896,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -345742,8 +346979,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -345788,8 +347026,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -345870,8 +347109,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -345916,8 +347156,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -345998,8 +347239,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346044,8 +347286,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346126,8 +347369,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346172,8 +347416,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346254,8 +347499,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346300,136 +347546,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346510,8 +347629,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346556,8 +347676,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346638,8 +347759,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346684,8 +347806,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346766,8 +347889,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346812,8 +347936,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -346894,8 +348019,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -346940,8 +348066,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347022,8 +348149,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347068,8 +348196,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347150,8 +348279,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347196,8 +348326,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347278,8 +348409,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347324,8 +348456,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347406,8 +348539,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347452,8 +348586,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347534,8 +348669,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347580,8 +348716,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347662,8 +348799,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347708,8 +348846,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347790,8 +348929,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347836,8 +348976,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -347918,8 +349059,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -347964,8 +349106,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348046,8 +349189,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348092,8 +349236,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348174,8 +349319,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348220,8 +349366,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348302,8 +349449,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348348,8 +349496,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348430,8 +349579,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348476,8 +349626,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348558,136 +349709,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348732,8 +349756,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348814,8 +349839,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348860,8 +349886,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -348942,8 +349969,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -348988,8 +350016,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349070,8 +350099,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349116,8 +350146,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349198,8 +350229,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349244,8 +350276,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349326,8 +350359,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349372,8 +350406,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349454,8 +350489,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349500,8 +350536,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349582,8 +350619,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349628,8 +350666,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349710,8 +350749,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349756,8 +350796,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349838,8 +350879,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -349884,8 +350926,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -349966,8 +351009,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350012,8 +351056,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350094,8 +351139,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350140,8 +351186,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350222,8 +351269,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350268,8 +351316,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350350,8 +351399,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350396,8 +351446,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350478,8 +351529,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350524,8 +351576,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350606,8 +351659,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350652,8 +351706,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350734,8 +351789,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -350780,136 +351836,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -350990,8 +351919,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351036,8 +351966,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351118,8 +352049,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351164,8 +352096,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351246,8 +352179,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351292,8 +352226,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351374,8 +352309,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351420,8 +352356,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351502,8 +352439,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351548,8 +352486,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351630,8 +352569,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351676,8 +352616,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351758,8 +352699,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351804,8 +352746,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -351886,8 +352829,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -351932,8 +352876,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352014,8 +352959,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352060,8 +353006,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352142,8 +353089,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352188,8 +353136,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352270,8 +353219,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352316,8 +353266,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352398,8 +353349,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352444,8 +353396,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352526,8 +353479,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352572,8 +353526,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352654,8 +353609,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352700,8 +353656,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352782,8 +353739,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352828,8 +353786,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -352910,8 +353869,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -352956,8 +353916,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353038,136 +353999,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353212,8 +354046,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353294,8 +354129,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353340,8 +354176,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353422,8 +354259,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353468,8 +354306,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353550,8 +354389,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353596,8 +354436,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353678,8 +354519,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353724,8 +354566,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353806,8 +354649,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353852,8 +354696,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -353934,8 +354779,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -353980,8 +354826,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354062,8 +354909,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354108,8 +354956,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354190,8 +355039,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354236,8 +355086,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354318,8 +355169,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354364,8 +355216,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354446,8 +355299,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354492,8 +355346,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354574,8 +355429,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354620,8 +355476,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354702,8 +355559,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354748,8 +355606,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354830,8 +355689,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -354876,8 +355736,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -354958,8 +355819,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355004,8 +355866,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355086,8 +355949,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355132,8 +355996,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355214,8 +356079,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355260,136 +356126,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355470,8 +356209,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355516,8 +356256,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355598,8 +356339,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355644,8 +356386,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355726,8 +356469,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355772,8 +356516,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355854,8 +356599,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -355900,8 +356646,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -355982,8 +356729,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356028,8 +356776,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356110,8 +356859,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356156,8 +356906,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356238,8 +356989,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356284,8 +357036,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356366,8 +357119,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356412,8 +357166,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356494,8 +357249,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356540,8 +357296,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356622,8 +357379,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356668,8 +357426,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356750,8 +357509,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356796,8 +357556,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -356878,8 +357639,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -356924,8 +357686,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357006,8 +357769,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357052,8 +357816,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357134,8 +357899,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357180,8 +357946,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357262,8 +358029,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357308,8 +358076,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357390,8 +358159,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357436,8 +358206,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357518,136 +358289,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357692,8 +358336,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357774,8 +358419,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357820,8 +358466,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -357902,8 +358549,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -357948,8 +358596,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358030,8 +358679,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358076,8 +358726,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358158,8 +358809,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358204,8 +358856,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358286,8 +358939,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358332,8 +358986,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358414,8 +359069,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358460,8 +359116,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358542,8 +359199,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358588,8 +359246,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358670,8 +359329,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358716,8 +359376,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358798,8 +359459,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358844,8 +359506,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -358926,8 +359589,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -358972,8 +359636,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359054,8 +359719,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359100,8 +359766,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359182,8 +359849,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359228,8 +359896,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359310,8 +359979,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359356,8 +360026,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359438,8 +360109,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359484,8 +360156,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359566,8 +360239,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359612,8 +360286,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359694,8 +360369,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359740,136 +360416,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -359950,8 +360499,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -359996,8 +360546,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360078,8 +360629,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360124,8 +360676,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360206,8 +360759,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360252,8 +360806,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360334,8 +360889,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360380,8 +360936,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360462,8 +361019,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360508,8 +361066,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360590,8 +361149,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360636,8 +361196,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360718,8 +361279,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360764,8 +361326,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360846,8 +361409,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -360892,8 +361456,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -360974,8 +361539,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361020,8 +361586,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361102,8 +361669,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361148,8 +361716,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361230,8 +361799,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361276,8 +361846,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361358,8 +361929,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361404,8 +361976,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361486,8 +362059,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361532,8 +362106,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361614,8 +362189,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361660,8 +362236,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361742,8 +362319,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361788,8 +362366,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361870,8 +362449,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -361916,8 +362496,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -361998,136 +362579,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362172,8 +362626,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362254,8 +362709,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362300,8 +362756,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362382,8 +362839,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362428,8 +362886,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362510,8 +362969,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362556,8 +363016,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362638,8 +363099,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362684,8 +363146,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362766,8 +363229,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362812,8 +363276,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -362894,8 +363359,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -362940,8 +363406,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363022,8 +363489,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363068,8 +363536,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363150,8 +363619,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363196,8 +363666,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363278,8 +363749,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363324,8 +363796,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363406,8 +363879,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363452,8 +363926,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363534,8 +364009,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363580,8 +364056,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363662,8 +364139,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363708,8 +364186,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363790,8 +364269,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363836,8 +364316,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -363918,8 +364399,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -363964,8 +364446,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364046,8 +364529,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364092,8 +364576,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364174,8 +364659,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364220,136 +364706,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364430,8 +364789,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364476,8 +364836,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364558,8 +364919,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364604,8 +364966,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364686,8 +365049,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364732,8 +365096,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364814,8 +365179,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364860,8 +365226,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -364942,8 +365309,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -364988,8 +365356,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365070,8 +365439,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365116,8 +365486,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365198,8 +365569,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365244,8 +365616,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365326,8 +365699,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365372,8 +365746,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365454,8 +365829,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365500,8 +365876,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365582,8 +365959,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365628,8 +366006,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365710,8 +366089,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365756,8 +366136,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365838,8 +366219,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -365884,8 +366266,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -365966,8 +366349,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366012,8 +366396,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366094,8 +366479,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366140,8 +366526,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366222,8 +366609,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366268,8 +366656,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366350,8 +366739,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366396,8 +366786,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366478,136 +366869,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366652,8 +366916,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366734,8 +366999,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366780,8 +367046,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366862,8 +367129,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -366908,8 +367176,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -366990,8 +367259,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367036,8 +367306,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367118,8 +367389,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367164,8 +367436,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367246,8 +367519,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367292,8 +367566,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367374,8 +367649,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367420,8 +367696,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367502,8 +367779,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367548,8 +367826,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367630,8 +367909,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367676,8 +367956,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367758,8 +368039,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367804,8 +368086,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -367886,8 +368169,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -367932,8 +368216,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368014,8 +368299,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368060,8 +368346,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368142,8 +368429,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368188,8 +368476,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368270,8 +368559,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368316,8 +368606,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368398,8 +368689,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368444,8 +368736,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368526,8 +368819,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368572,8 +368866,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368654,8 +368949,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368700,136 +368996,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -368910,8 +369079,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -368956,8 +369126,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369038,8 +369209,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369084,8 +369256,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369166,8 +369339,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369212,8 +369386,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369294,8 +369469,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369340,8 +369516,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369422,8 +369599,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369468,8 +369646,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369550,8 +369729,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369596,8 +369776,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369678,8 +369859,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369724,8 +369906,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369806,8 +369989,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369852,8 +370036,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -369934,8 +370119,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -369980,8 +370166,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370062,8 +370249,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370108,8 +370296,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370190,8 +370379,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370236,8 +370426,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370318,8 +370509,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370364,8 +370556,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370446,8 +370639,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370492,8 +370686,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370574,8 +370769,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370620,8 +370816,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370702,8 +370899,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370748,8 +370946,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370830,8 +371029,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -370876,8 +371076,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -370958,136 +371159,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371132,8 +371206,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371214,8 +371289,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371260,8 +371336,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371342,8 +371419,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371388,8 +371466,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371470,8 +371549,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371516,8 +371596,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371598,8 +371679,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371644,8 +371726,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371726,8 +371809,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371772,8 +371856,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371854,8 +371939,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -371900,8 +371986,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -371982,8 +372069,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372028,8 +372116,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372110,8 +372199,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372156,8 +372246,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372238,8 +372329,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372284,8 +372376,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372366,8 +372459,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372412,8 +372506,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372494,8 +372589,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372540,8 +372636,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372622,8 +372719,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372668,8 +372766,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372750,8 +372849,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372796,8 +372896,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -372878,8 +372979,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -372924,8 +373026,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373006,8 +373109,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373052,8 +373156,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373134,8 +373239,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373180,136 +373286,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373390,8 +373369,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373436,8 +373416,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373518,8 +373499,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373564,8 +373546,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373646,8 +373629,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373692,8 +373676,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373774,8 +373759,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373820,8 +373806,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -373902,8 +373889,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -373948,8 +373936,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374030,8 +374019,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374076,8 +374066,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374158,8 +374149,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374204,8 +374196,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374286,8 +374279,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374332,8 +374326,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374414,8 +374409,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374460,8 +374456,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374542,8 +374539,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374588,8 +374586,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374670,8 +374669,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374716,8 +374716,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374798,8 +374799,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374844,8 +374846,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -374926,8 +374929,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -374972,8 +374976,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375054,8 +375059,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375100,8 +375106,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375182,8 +375189,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375228,8 +375236,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375310,8 +375319,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375356,8 +375366,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375438,136 +375449,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375612,8 +375496,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375694,8 +375579,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375740,8 +375626,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375822,8 +375709,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375868,8 +375756,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -375950,8 +375839,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -375996,8 +375886,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376078,8 +375969,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376124,8 +376016,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376206,8 +376099,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376252,8 +376146,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376334,8 +376229,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376380,8 +376276,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376462,8 +376359,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376508,8 +376406,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376590,8 +376489,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376636,8 +376536,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376718,8 +376619,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376764,8 +376666,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376846,8 +376749,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -376892,8 +376796,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -376974,8 +376879,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377020,8 +376926,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377102,8 +377009,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377148,8 +377056,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377230,8 +377139,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377276,8 +377186,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377358,8 +377269,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377404,8 +377316,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377486,8 +377399,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377532,8 +377446,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377614,8 +377529,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377660,136 +377576,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377870,8 +377659,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -377916,8 +377706,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -377998,8 +377789,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378044,8 +377836,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378126,8 +377919,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378172,8 +377966,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378254,8 +378049,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378300,8 +378096,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378382,8 +378179,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378428,8 +378226,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378510,8 +378309,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378556,8 +378356,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378638,8 +378439,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378684,8 +378486,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378766,8 +378569,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378812,8 +378616,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -378894,8 +378699,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -378940,8 +378746,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379022,8 +378829,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379068,8 +378876,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379150,8 +378959,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379196,8 +379006,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379278,8 +379089,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379324,8 +379136,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379406,8 +379219,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379452,8 +379266,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379534,8 +379349,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379580,8 +379396,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379662,8 +379479,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379708,8 +379526,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379790,8 +379609,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -379836,8 +379656,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -379918,136 +379739,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380092,8 +379786,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380174,8 +379869,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380220,8 +379916,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380302,8 +379999,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380348,8 +380046,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380430,8 +380129,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380476,8 +380176,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380558,8 +380259,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380604,8 +380306,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380686,8 +380389,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380732,8 +380436,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380814,8 +380519,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380860,8 +380566,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -380942,8 +380649,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -380988,8 +380696,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381070,8 +380779,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381116,8 +380826,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381198,8 +380909,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381244,8 +380956,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381326,8 +381039,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381372,8 +381086,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381454,8 +381169,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381500,8 +381216,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381582,8 +381299,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381628,8 +381346,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381710,8 +381429,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381756,8 +381476,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381838,8 +381559,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -381884,8 +381606,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -381966,8 +381689,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382012,8 +381736,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382094,8 +381819,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382140,136 +381866,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382350,8 +381949,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382396,8 +381996,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382478,8 +382079,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382524,8 +382126,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382606,8 +382209,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382652,8 +382256,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382734,8 +382339,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382780,8 +382386,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382862,8 +382469,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -382908,8 +382516,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -382990,8 +382599,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383036,8 +382646,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383118,8 +382729,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383164,8 +382776,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383246,8 +382859,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383292,8 +382906,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383374,8 +382989,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383420,8 +383036,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383502,8 +383119,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383548,8 +383166,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383630,8 +383249,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383676,8 +383296,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383758,8 +383379,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383804,8 +383426,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -383886,8 +383509,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -383932,8 +383556,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384014,8 +383639,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384060,8 +383686,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384142,8 +383769,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384188,8 +383816,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384270,8 +383899,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384316,8 +383946,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384398,136 +384029,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384572,8 +384076,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384654,8 +384159,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384700,8 +384206,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384782,8 +384289,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384828,8 +384336,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -384910,8 +384419,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -384956,8 +384466,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385038,8 +384549,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385084,8 +384596,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385166,8 +384679,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385212,8 +384726,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385294,8 +384809,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385340,8 +384856,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385422,8 +384939,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385468,8 +384986,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385550,8 +385069,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385596,8 +385116,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385678,8 +385199,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385724,8 +385246,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385806,8 +385329,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385852,8 +385376,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -385934,8 +385459,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -385980,8 +385506,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386062,8 +385589,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386108,8 +385636,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386190,8 +385719,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386236,8 +385766,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386318,8 +385849,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386364,8 +385896,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386446,8 +385979,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386492,8 +386026,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386574,8 +386109,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386620,136 +386156,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386830,8 +386239,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -386876,8 +386286,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -386958,8 +386369,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387004,8 +386416,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387086,8 +386499,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387132,8 +386546,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387214,8 +386629,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387260,8 +386676,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387342,8 +386759,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387388,8 +386806,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387470,8 +386889,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387516,8 +386936,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387598,8 +387019,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387644,8 +387066,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387726,8 +387149,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387772,8 +387196,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387854,8 +387279,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -387900,8 +387326,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -387982,8 +387409,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388028,8 +387456,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388110,8 +387539,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388156,8 +387586,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388238,8 +387669,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388284,8 +387716,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388366,8 +387799,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388412,8 +387846,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388494,8 +387929,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388540,8 +387976,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388622,8 +388059,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388668,8 +388106,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388750,8 +388189,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -388796,8 +388236,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -388878,136 +388319,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.007",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1572",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1583.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.006",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1188",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
-        },
-        {
-            "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
-        },
-        {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
-        },
-        {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567.002",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1028",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1499",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1598",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1223",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.004",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1102.001",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.003",
-            "score": 5,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389052,8 +388366,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389134,8 +388449,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389180,8 +388496,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389262,8 +388579,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389308,8 +388626,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389390,8 +388709,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389436,8 +388756,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389518,8 +388839,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389564,8 +388886,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389646,8 +388969,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389692,8 +389016,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389774,8 +389099,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389820,8 +389146,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -389902,8 +389229,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -389948,8 +389276,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390030,8 +389359,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390076,8 +389406,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390158,8 +389489,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390204,8 +389536,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390286,8 +389619,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390332,8 +389666,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390414,8 +389749,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390460,8 +389796,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390542,8 +389879,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390588,8 +389926,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390670,8 +390009,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390716,8 +390056,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390798,8 +390139,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390844,8 +390186,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -390926,8 +390269,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -390972,8 +390316,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391054,8 +390399,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391100,8 +390446,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391182,8 +390529,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391228,8 +390576,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391310,8 +390659,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391356,8 +390706,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391438,8 +390789,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391484,8 +390836,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391566,9 +390919,140 @@
         },
         {
             "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1056",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.003",
             "score": 5,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {
             "techniqueID": "T1218.007",
             "score": 5,
@@ -391612,9 +391096,140 @@
         },
         {
             "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1056",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213",
             "score": 5,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {
             "techniqueID": "T1566",
             "score": 4,
@@ -391694,8 +391309,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391740,8 +391356,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391822,8 +391439,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391868,8 +391486,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -391950,8 +391569,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -391996,8 +391616,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -392078,8 +391699,9 @@
         },
         {
             "techniqueID": "T1069.002",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1218.007",
@@ -392124,8 +391746,9 @@
         },
         {
             "techniqueID": "T1069.001",
-            "score": 5,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
             "techniqueID": "T1566",
@@ -392206,9 +391829,140 @@
         },
         {
             "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1056",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.003",
             "score": 5,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {
             "techniqueID": "T1218.007",
             "score": 5,
@@ -392252,9 +392006,140 @@
         },
         {
             "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1056",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1572",
             "score": 5,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
         {
             "techniqueID": "T1566",
             "score": 4,
@@ -392328,1719 +392213,1953 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1487",
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1145",
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1145",
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1145",
+            "techniqueID": "T1069.001",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1102.001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.004",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.002",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1496",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+            "techniqueID": "T1598",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
+        },
+        {
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1210",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1069.001",
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml"
         },
         {
-            "techniqueID": "T1588.002",
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
@@ -449579,6 +449698,4767 @@
             "score": 4,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1561.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1014",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1093",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1586.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1091",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1552.004",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1199",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.001",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055.012",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
         {
             "techniqueID": "T1067",
             "score": 3,
@@ -449611,9 +454491,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -449667,9 +454751,212 @@
         },
         {
             "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -449813,9 +455100,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -449869,9 +455360,212 @@
         },
         {
             "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -450015,9 +455709,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -450071,9 +455969,212 @@
         },
         {
             "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -450217,9 +456318,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -450273,9 +456578,212 @@
         },
         {
             "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -450419,8 +456927,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -450475,9 +456984,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -450621,8 +457130,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -450677,9 +457187,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -450823,8 +457333,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -450879,9 +457390,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -451025,9 +457536,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -451081,9 +457796,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -451227,9 +457942,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -451283,9 +458202,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -451429,210 +458348,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -451687,9 +458405,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -451833,8 +458551,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -451889,9 +458608,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -452035,8 +458754,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -452091,9 +458811,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -452237,8 +458957,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -452293,9 +459014,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -452439,8 +459160,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -452495,9 +459217,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -452641,8 +459363,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -452697,9 +459420,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -452843,8 +459566,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -452899,9 +459623,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -453045,8 +459769,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -453101,9 +459826,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -453247,8 +459972,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -453303,9 +460029,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -453449,8 +460175,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -453505,9 +460232,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -453651,8 +460378,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -453707,9 +460435,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -453853,8 +460581,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -453909,9 +460638,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -454055,210 +460784,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -454313,9 +460841,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -454459,8 +460987,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -454515,9 +461044,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -454661,8 +461190,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -454717,9 +461247,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -454863,8 +461393,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -454919,9 +461450,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -455065,8 +461596,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -455121,9 +461653,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -455267,8 +461799,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -455323,9 +461856,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -455469,8 +462002,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -455525,9 +462059,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -455671,8 +462205,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -455727,9 +462262,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -455873,8 +462408,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -455929,9 +462465,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -456075,8 +462611,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -456131,9 +462668,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -456277,8 +462814,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -456333,9 +462871,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -456479,8 +463017,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -456535,9 +463074,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -456681,210 +463220,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -456939,9 +463277,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -457085,8 +463423,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -457141,9 +463480,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -457287,8 +463626,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -457343,9 +463683,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -457489,8 +463829,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -457545,9 +463886,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -457691,8 +464032,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -457747,9 +464089,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -457893,8 +464235,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -457949,9 +464292,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -458095,8 +464438,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -458151,9 +464495,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -458297,8 +464641,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -458353,9 +464698,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -458499,8 +464844,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -458555,9 +464901,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -458701,8 +465047,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -458757,9 +465104,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -458903,8 +465250,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -458959,9 +465307,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -459105,8 +465453,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -459161,9 +465510,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -459307,210 +465656,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -459565,9 +465713,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -459711,8 +465859,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -459767,9 +465916,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -459913,8 +466062,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -459969,9 +466119,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -460115,8 +466265,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -460171,9 +466322,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -460317,8 +466468,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -460373,9 +466525,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -460519,8 +466671,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -460575,9 +466728,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -460721,8 +466874,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -460777,9 +466931,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -460923,8 +467077,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -460979,9 +467134,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -461125,8 +467280,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -461181,9 +467337,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -461327,8 +467483,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -461383,9 +467540,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -461529,8 +467686,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -461585,9 +467743,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -461731,8 +467889,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -461787,9 +467946,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -461933,210 +468092,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -462191,9 +468149,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -462337,8 +468295,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -462393,9 +468352,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -462539,8 +468498,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -462595,9 +468555,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -462741,8 +468701,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -462797,9 +468758,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -462943,8 +468904,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -462999,9 +468961,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -463145,8 +469107,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -463201,9 +469164,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -463347,8 +469310,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -463403,9 +469367,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -463549,8 +469513,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -463605,9 +469570,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -463751,8 +469716,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -463807,9 +469773,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -463953,8 +469919,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -464009,9 +469976,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -464155,8 +470122,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -464211,9 +470179,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -464357,8 +470325,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -464413,9 +470382,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -464559,210 +470528,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -464817,9 +470585,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -464963,8 +470731,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -465019,9 +470788,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -465165,8 +470934,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -465221,9 +470991,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -465367,8 +471137,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -465423,9 +471194,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -465569,8 +471340,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -465625,9 +471397,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -465771,8 +471543,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -465827,9 +471600,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -465973,8 +471746,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -466029,9 +471803,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -466175,8 +471949,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -466231,9 +472006,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -466377,8 +472152,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -466433,9 +472209,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -466579,8 +472355,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -466635,9 +472412,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -466781,8 +472558,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -466837,9 +472615,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -466983,8 +472761,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -467039,9 +472818,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -467185,210 +472964,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -467443,9 +473021,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -467589,8 +473167,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -467645,9 +473224,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -467791,8 +473370,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -467847,9 +473427,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -467993,8 +473573,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -468049,9 +473630,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -468195,8 +473776,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -468251,9 +473833,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -468397,8 +473979,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -468453,9 +474036,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -468599,8 +474182,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -468655,9 +474239,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -468801,8 +474385,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -468857,9 +474442,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -469003,8 +474588,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -469059,9 +474645,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -469205,8 +474791,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -469261,9 +474848,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -469407,8 +474994,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -469463,9 +475051,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -469609,8 +475197,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -469665,9 +475254,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -469811,210 +475400,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -470069,9 +475457,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -470215,8 +475603,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -470271,9 +475660,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -470417,8 +475806,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -470473,9 +475863,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -470619,8 +476009,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -470675,9 +476066,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -470821,8 +476212,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -470877,9 +476269,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -471023,8 +476415,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -471079,9 +476472,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -471225,8 +476618,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -471281,9 +476675,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -471427,8 +476821,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -471483,9 +476878,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -471629,8 +477024,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -471685,9 +477081,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -471831,8 +477227,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -471887,9 +477284,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -472033,8 +477430,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -472089,9 +477487,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -472235,8 +477633,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -472291,9 +477690,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -472437,210 +477836,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -472695,9 +477893,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -472841,8 +478039,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -472897,9 +478096,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -473043,8 +478242,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -473099,9 +478299,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -473245,8 +478445,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -473301,9 +478502,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -473447,8 +478648,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -473503,9 +478705,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -473649,8 +478851,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -473705,9 +478908,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -473851,8 +479054,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -473907,9 +479111,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -474053,8 +479257,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -474109,9 +479314,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -474255,8 +479460,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -474311,9 +479517,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -474457,8 +479663,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -474513,9 +479720,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -474659,8 +479866,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -474715,9 +479923,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -474861,8 +480069,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -474917,9 +480126,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -475063,210 +480272,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -475321,9 +480329,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -475467,8 +480475,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -475523,9 +480532,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -475669,8 +480678,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -475725,9 +480735,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -475871,8 +480881,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -475927,9 +480938,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -476073,8 +481084,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -476129,9 +481141,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -476275,8 +481287,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -476331,9 +481344,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -476477,8 +481490,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -476533,9 +481547,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -476679,8 +481693,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -476735,9 +481750,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -476881,8 +481896,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -476937,9 +481953,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -477083,8 +482099,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -477139,9 +482156,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -477285,8 +482302,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -477341,9 +482359,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -477487,8 +482505,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -477543,9 +482562,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -477689,210 +482708,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -477947,9 +482765,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -478093,8 +482911,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -478149,9 +482968,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -478295,8 +483114,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -478351,9 +483171,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -478497,8 +483317,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -478553,9 +483374,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -478699,8 +483520,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -478755,9 +483577,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -478901,8 +483723,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -478957,9 +483780,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -479103,8 +483926,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -479159,9 +483983,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -479305,8 +484129,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -479361,9 +484186,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -479507,8 +484332,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -479563,9 +484389,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -479709,8 +484535,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -479765,9 +484592,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -479911,8 +484738,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -479967,9 +484795,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -480113,8 +484941,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -480169,9 +484998,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -480315,210 +485144,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -480573,9 +485201,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -480719,8 +485347,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -480775,9 +485404,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -480921,8 +485550,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -480977,9 +485607,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -481123,8 +485753,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -481179,9 +485810,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -481325,8 +485956,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -481381,9 +486013,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -481527,8 +486159,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -481583,9 +486216,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -481729,8 +486362,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -481785,9 +486419,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -481931,8 +486565,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -481987,9 +486622,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -482133,8 +486768,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -482189,9 +486825,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -482335,8 +486971,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -482391,9 +487028,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -482537,8 +487174,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -482593,9 +487231,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -482739,8 +487377,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -482795,9 +487434,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -482941,210 +487580,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -483199,9 +487637,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -483345,8 +487783,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -483401,9 +487840,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -483547,8 +487986,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -483603,9 +488043,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -483749,8 +488189,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -483805,9 +488246,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -483951,8 +488392,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -484007,9 +488449,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -484153,8 +488595,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -484209,9 +488652,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -484355,8 +488798,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -484411,9 +488855,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -484557,8 +489001,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -484613,9 +489058,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -484759,8 +489204,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -484815,9 +489261,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -484961,8 +489407,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -485017,9 +489464,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -485163,8 +489610,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -485219,9 +489667,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -485365,8 +489813,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -485421,9 +489870,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -485567,210 +490016,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -485825,9 +490073,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -485971,8 +490219,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -486027,9 +490276,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -486173,8 +490422,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -486229,9 +490479,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -486375,8 +490625,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -486431,9 +490682,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -486577,8 +490828,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -486633,9 +490885,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -486779,8 +491031,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -486835,9 +491088,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -486981,8 +491234,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -487037,9 +491291,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -487183,8 +491437,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -487239,9 +491494,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -487385,8 +491640,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -487441,9 +491697,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -487587,8 +491843,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -487643,9 +491900,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -487789,8 +492046,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -487845,9 +492103,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -487991,8 +492249,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -488047,9 +492306,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -488193,210 +492452,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -488451,9 +492509,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -488597,8 +492655,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -488653,9 +492712,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -488799,8 +492858,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -488855,9 +492915,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -489001,8 +493061,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -489057,9 +493118,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -489203,8 +493264,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -489259,9 +493321,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -489405,8 +493467,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -489461,9 +493524,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -489607,8 +493670,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -489663,9 +493727,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -489809,8 +493873,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -489865,9 +493930,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -490011,8 +494076,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -490067,9 +494133,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -490213,8 +494279,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -490269,9 +494336,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -490415,8 +494482,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -490471,9 +494539,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -490617,8 +494685,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -490673,9 +494742,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -490819,210 +494888,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -491077,9 +494945,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -491223,8 +495091,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -491279,9 +495148,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -491425,8 +495294,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -491481,9 +495351,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -491627,8 +495497,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -491683,9 +495554,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -491829,8 +495700,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -491885,9 +495757,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -492031,8 +495903,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -492087,9 +495960,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -492233,8 +496106,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -492289,9 +496163,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -492435,8 +496309,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -492491,9 +496366,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -492637,8 +496512,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -492693,9 +496569,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -492839,8 +496715,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -492895,9 +496772,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -493041,8 +496918,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -493097,9 +496975,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -493243,8 +497121,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -493299,9 +497178,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -493445,210 +497324,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -493703,9 +497381,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -493849,8 +497527,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -493905,9 +497584,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -494051,8 +497730,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -494107,9 +497787,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -494253,8 +497933,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -494309,9 +497990,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -494455,8 +498136,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -494511,9 +498193,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -494657,8 +498339,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -494713,9 +498396,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -494859,8 +498542,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -494915,9 +498599,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -495061,8 +498745,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -495117,9 +498802,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -495263,8 +498948,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -495319,9 +499005,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -495465,8 +499151,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -495521,9 +499208,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -495667,8 +499354,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -495723,9 +499411,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -495869,8 +499557,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -495925,9 +499614,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -496071,210 +499760,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -496329,9 +499817,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -496475,8 +499963,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -496531,9 +500020,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -496677,8 +500166,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -496733,9 +500223,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -496879,8 +500369,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -496935,9 +500426,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -497081,8 +500572,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -497137,9 +500629,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -497283,8 +500775,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -497339,9 +500832,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -497485,8 +500978,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -497541,9 +501035,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -497687,8 +501181,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -497743,9 +501238,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -497889,8 +501384,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -497945,9 +501441,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -498091,8 +501587,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -498147,9 +501644,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -498293,8 +501790,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -498349,9 +501847,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -498495,8 +501993,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -498551,9 +502050,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -498697,210 +502196,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -498955,9 +502253,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -499101,8 +502399,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -499157,9 +502456,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -499303,8 +502602,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -499359,9 +502659,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -499505,8 +502805,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -499561,9 +502862,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -499707,8 +503008,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -499763,9 +503065,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -499909,8 +503211,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -499965,9 +503268,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -500111,8 +503414,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -500167,9 +503471,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -500313,8 +503617,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -500369,9 +503674,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -500515,8 +503820,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -500571,9 +503877,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -500717,8 +504023,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -500773,9 +504080,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -500919,8 +504226,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -500975,9 +504283,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -501121,8 +504429,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -501177,9 +504486,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -501323,210 +504632,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -501581,9 +504689,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -501727,8 +504835,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -501783,9 +504892,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -501929,8 +505038,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -501985,9 +505095,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -502131,8 +505241,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -502187,9 +505298,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -502333,8 +505444,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -502389,9 +505501,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -502535,8 +505647,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -502591,9 +505704,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -502737,8 +505850,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -502793,9 +505907,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -502939,8 +506053,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -502995,9 +506110,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -503141,8 +506256,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -503197,9 +506313,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -503343,8 +506459,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -503399,9 +506516,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -503545,8 +506662,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -503601,9 +506719,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -503747,8 +506865,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -503803,9 +506922,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -503949,210 +507068,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -504207,9 +507125,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -504353,8 +507271,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -504409,9 +507328,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -504555,8 +507474,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -504611,9 +507531,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -504757,8 +507677,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -504813,9 +507734,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -504959,8 +507880,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -505015,9 +507937,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -505161,8 +508083,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -505217,9 +508140,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -505363,8 +508286,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -505419,9 +508343,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -505565,8 +508489,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -505621,9 +508546,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -505767,8 +508692,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -505823,9 +508749,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -505969,8 +508895,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -506025,9 +508952,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -506171,8 +509098,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -506227,9 +509155,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -506373,8 +509301,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -506429,9 +509358,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -506575,210 +509504,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -506833,9 +509561,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -506979,8 +509707,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -507035,9 +509764,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -507181,8 +509910,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -507237,9 +509967,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -507383,8 +510113,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -507439,9 +510170,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -507585,8 +510316,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -507641,9 +510373,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -507787,8 +510519,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -507843,9 +510576,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -507989,8 +510722,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -508045,9 +510779,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -508191,8 +510925,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -508247,9 +510982,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -508393,8 +511128,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -508449,9 +511185,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -508595,8 +511331,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -508651,9 +511388,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -508797,8 +511534,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -508853,9 +511591,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -508999,8 +511737,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -509055,9 +511794,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -509201,210 +511940,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -509459,9 +511997,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -509605,8 +512143,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -509661,9 +512200,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -509807,8 +512346,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -509863,9 +512403,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -510009,8 +512549,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -510065,9 +512606,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -510211,8 +512752,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -510267,9 +512809,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -510413,8 +512955,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -510469,9 +513012,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -510615,8 +513158,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -510671,9 +513215,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -510817,8 +513361,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -510873,9 +513418,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -511019,8 +513564,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -511075,9 +513621,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -511221,8 +513767,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -511277,9 +513824,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -511423,8 +513970,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -511479,9 +514027,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -511625,8 +514173,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -511681,9 +514230,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -511827,210 +514376,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -512085,9 +514433,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -512231,8 +514579,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -512287,9 +514636,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -512433,8 +514782,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -512489,9 +514839,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -512635,8 +514985,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -512691,9 +515042,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -512837,8 +515188,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -512893,9 +515245,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -513039,8 +515391,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -513095,9 +515448,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -513241,8 +515594,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -513297,9 +515651,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -513443,8 +515797,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -513499,9 +515854,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -513645,8 +516000,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -513701,9 +516057,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -513847,8 +516203,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -513903,9 +516260,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -514049,8 +516406,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -514105,9 +516463,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -514251,8 +516609,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -514307,9 +516666,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -514453,210 +516812,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -514711,9 +516869,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -514857,8 +517015,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -514913,9 +517072,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -515059,8 +517218,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -515115,9 +517275,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -515261,8 +517421,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -515317,9 +517478,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -515463,8 +517624,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -515519,9 +517681,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -515665,8 +517827,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -515721,9 +517884,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -515867,8 +518030,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -515923,9 +518087,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -516069,8 +518233,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -516125,9 +518290,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -516271,8 +518436,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -516327,9 +518493,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -516473,8 +518639,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -516529,9 +518696,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -516675,8 +518842,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -516731,9 +518899,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -516877,8 +519045,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -516933,9 +519102,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -517079,210 +519248,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1080",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1115",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1587.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1567",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1562.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1595.002",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1547.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1583.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1074",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1104",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
-        },
-        {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1097",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
-        },
-        {
-            "techniqueID": "T1573",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
-        },
-        {
-            "techniqueID": "T1027.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1500",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.004",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
-        },
-        {
-            "techniqueID": "T1498",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1588.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1003.006",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1053.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1529",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1067",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1557",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1213.002",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1016.001",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.003",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1025",
-            "score": 3,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -517337,9 +519305,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -517483,8 +519451,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -517539,9 +519508,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -517685,8 +519654,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -517741,9 +519711,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -517887,8 +519857,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -517943,9 +519914,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -518089,8 +520060,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -518145,9 +520117,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -518291,8 +520263,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -518347,9 +520320,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -518493,8 +520466,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -518549,9 +520523,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -518695,8 +520669,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -518751,9 +520726,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -518897,8 +520872,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -518953,9 +520929,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -519099,8 +521075,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -519155,9 +521132,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -519301,8 +521278,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -519357,9 +521335,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -519503,8 +521481,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -519559,9 +521538,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -519705,8 +521684,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -519761,9 +521741,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -519907,8 +521887,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -519963,9 +521944,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -520109,8 +522090,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -520165,9 +522147,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -520311,8 +522293,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -520367,9 +522350,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -520513,8 +522496,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -520569,9 +522553,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -520715,8 +522699,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -520771,9 +522756,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -520917,8 +522902,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -520973,9 +522959,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -521119,8 +523105,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -521175,9 +523162,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -521321,8 +523308,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -521377,9 +523365,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -521523,8 +523511,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -521579,9 +523568,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -521725,8 +523714,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -521781,9 +523771,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -521927,9 +523917,213 @@
         },
         {
             "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
+        {
+            "techniqueID": "T1080",
             "score": 3,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1497.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1115",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1587.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1567",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1562.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1595.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1547.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1482",
+            "score": -5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1583.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1074",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1104",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1072",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml"
+        },
+        {
+            "techniqueID": "T1593",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1097",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1201",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+        },
+        {
+            "techniqueID": "T1573",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml"
+        },
+        {
+            "techniqueID": "T1027.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1500",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.004",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1485",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml"
+        },
+        {
+            "techniqueID": "T1498",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1588.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.006",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1053.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1529",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1067",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1557",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1213.002",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1016.001",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.003",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1025",
+            "score": 3,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.001",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
+        },
         {
             "techniqueID": "T1080",
             "score": 3,
@@ -521983,9 +524177,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -522129,8 +524323,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -522185,9 +524380,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -522331,8 +524526,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -522387,9 +524583,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -522533,8 +524729,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -522589,9 +524786,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -522735,8 +524932,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -522791,9 +524989,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -522937,8 +525135,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -522993,9 +525192,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -523139,8 +525338,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -523195,9 +525395,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -523341,8 +525541,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -523397,9 +525598,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -523543,8 +525744,9 @@
         },
         {
             "techniqueID": "T1114.001",
-            "score": 3,
-            "showSubtechniques": false
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml"
         },
         {
             "techniqueID": "T1080",
@@ -523599,9 +525801,9 @@
         },
         {
             "techniqueID": "T1482",
-            "score": 0,
+            "score": -5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
             "techniqueID": "T1583.003",
@@ -523811,9 +526013,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -524054,9 +526256,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -524297,9 +526499,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -524540,9 +526742,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -524783,9 +526985,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -525026,9 +527228,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -525269,9 +527471,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -525512,9 +527714,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -525755,9 +527957,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -525998,9 +528200,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -526241,9 +528443,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -526484,9 +528686,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -526727,9 +528929,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -526970,9 +529172,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -527213,9 +529415,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -527456,9 +529658,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -527699,9 +529901,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -527942,9 +530144,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -528185,9 +530387,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -528428,9 +530630,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -528671,9 +530873,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -528914,9 +531116,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -529157,9 +531359,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -529400,9 +531602,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -529643,9 +531845,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -529886,9 +532088,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -530129,9 +532331,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -530372,9 +532574,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -530615,9 +532817,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -530858,9 +533060,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -531101,9 +533303,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -531344,9 +533546,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -531587,9 +533789,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -531830,9 +534032,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -532073,9 +534275,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -532316,9 +534518,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -532559,9 +534761,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -532802,9 +535004,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -533045,9 +535247,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -533288,9 +535490,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -533531,9 +535733,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -533774,9 +535976,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -534017,9 +536219,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -534260,9 +536462,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -534503,9 +536705,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -534746,9 +536948,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -534989,9 +537191,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -535232,9 +537434,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -535475,9 +537677,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -535718,9 +537920,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -535961,9 +538163,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536204,9 +538406,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536447,9 +538649,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536690,9 +538892,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536933,9 +539135,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537176,9 +539378,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537419,9 +539621,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537662,9 +539864,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537905,9 +540107,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538148,9 +540350,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538391,9 +540593,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538634,9 +540836,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538877,9 +541079,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539120,9 +541322,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539363,9 +541565,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539606,9 +541808,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539849,9 +542051,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540092,9 +542294,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540335,9 +542537,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540578,9 +542780,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540821,9 +543023,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541064,9 +543266,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541307,9 +543509,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541550,9 +543752,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541793,9 +543995,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542036,9 +544238,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542279,9 +544481,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542522,9 +544724,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542765,9 +544967,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543008,9 +545210,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543251,9 +545453,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543494,9 +545696,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543737,9 +545939,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543980,9 +546182,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544223,9 +546425,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544466,9 +546668,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544709,9 +546911,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544952,9 +547154,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545195,9 +547397,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545438,9 +547640,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545681,9 +547883,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545924,9 +548126,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546167,9 +548369,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546410,9 +548612,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546653,9 +548855,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546896,9 +549098,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547139,9 +549341,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547382,9 +549584,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547625,9 +549827,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547868,9 +550070,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548111,9 +550313,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548354,9 +550556,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548597,9 +550799,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548840,9 +551042,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549083,9 +551285,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549326,9 +551528,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549569,9 +551771,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549812,9 +552014,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550055,9 +552257,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550298,9 +552500,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550541,9 +552743,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550784,9 +552986,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551027,9 +553229,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551270,9 +553472,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551513,9 +553715,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551756,9 +553958,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551999,9 +554201,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552242,9 +554444,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552485,9 +554687,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552728,9 +554930,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552971,9 +555173,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553214,9 +555416,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553457,9 +555659,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553700,9 +555902,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553943,9 +556145,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554186,9 +556388,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554429,9 +556631,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554672,9 +556874,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554915,9 +557117,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555158,9 +557360,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555401,9 +557603,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555644,9 +557846,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555887,9 +558089,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556130,9 +558332,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556373,9 +558575,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556616,9 +558818,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556859,9 +559061,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557102,9 +559304,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557345,9 +559547,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557588,9 +559790,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557831,9 +560033,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558074,9 +560276,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558317,9 +560519,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558560,9 +560762,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558803,9 +561005,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559046,9 +561248,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559289,9 +561491,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559532,9 +561734,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559775,9 +561977,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560018,9 +562220,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560261,9 +562463,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560504,9 +562706,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560747,9 +562949,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560990,9 +563192,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561233,9 +563435,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561476,9 +563678,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561719,9 +563921,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561962,9 +564164,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562205,9 +564407,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562448,9 +564650,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562691,9 +564893,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562934,9 +565136,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563177,9 +565379,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563420,9 +565622,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563663,9 +565865,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563906,9 +566108,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564149,9 +566351,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564392,9 +566594,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564635,9 +566837,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564878,9 +567080,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565121,9 +567323,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565364,9 +567566,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565607,9 +567809,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565850,9 +568052,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566093,9 +568295,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566336,9 +568538,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566579,9 +568781,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566822,9 +569024,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567065,9 +569267,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567308,9 +569510,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567551,9 +569753,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567794,9 +569996,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568037,9 +570239,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568280,9 +570482,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568523,9 +570725,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568766,9 +570968,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569009,9 +571211,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569252,9 +571454,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569495,9 +571697,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569738,9 +571940,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569981,9 +572183,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570224,9 +572426,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570467,9 +572669,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570710,9 +572912,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570953,9 +573155,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571196,9 +573398,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571439,9 +573641,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571682,9 +573884,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571925,9 +574127,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572168,9 +574370,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572411,9 +574613,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572654,9 +574856,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572897,9 +575099,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573140,9 +575342,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573383,9 +575585,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573626,9 +575828,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573869,9 +576071,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574112,9 +576314,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574355,9 +576557,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574598,9 +576800,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574841,9 +577043,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575084,9 +577286,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575327,9 +577529,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575570,9 +577772,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575813,9 +578015,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576056,9 +578258,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576299,9 +578501,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576542,9 +578744,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576785,9 +578987,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577028,9 +579230,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577271,9 +579473,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577514,9 +579716,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577757,9 +579959,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578000,9 +580202,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578243,9 +580445,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578486,9 +580688,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578729,9 +580931,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578972,9 +581174,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579215,9 +581417,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579458,9 +581660,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579701,9 +581903,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579944,9 +582146,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580187,9 +582389,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580430,9 +582632,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580673,9 +582875,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580916,9 +583118,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581159,9 +583361,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581402,9 +583604,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581645,9 +583847,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581888,9 +584090,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582131,9 +584333,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582374,9 +584576,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582617,9 +584819,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582860,9 +585062,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583103,9 +585305,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583346,9 +585548,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583589,9 +585791,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583832,9 +586034,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584075,9 +586277,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584318,9 +586520,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584561,9 +586763,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584804,9 +587006,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585047,9 +587249,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585290,9 +587492,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585533,9 +587735,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585776,9 +587978,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586019,9 +588221,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586262,9 +588464,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586505,9 +588707,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586748,9 +588950,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586991,9 +589193,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587234,9 +589436,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587477,9 +589679,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587720,9 +589922,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587963,9 +590165,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588206,9 +590408,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588449,9 +590651,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588692,9 +590894,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588935,9 +591137,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589178,9 +591380,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589421,9 +591623,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589664,9 +591866,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589907,9 +592109,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590150,9 +592352,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590393,9 +592595,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590636,9 +592838,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590879,9 +593081,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591122,9 +593324,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591365,9 +593567,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591608,9 +593810,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591851,9 +594053,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592094,9 +594296,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592337,9 +594539,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592580,9 +594782,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592823,9 +595025,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593066,9 +595268,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593309,9 +595511,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593552,9 +595754,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593795,9 +595997,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594038,9 +596240,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594281,9 +596483,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594524,9 +596726,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594767,9 +596969,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595010,9 +597212,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595253,9 +597455,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595496,9 +597698,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595739,9 +597941,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595982,9 +598184,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596225,9 +598427,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596468,9 +598670,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596711,9 +598913,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596954,9 +599156,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597197,9 +599399,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597440,9 +599642,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597683,9 +599885,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597926,9 +600128,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598169,9 +600371,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598412,9 +600614,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598655,9 +600857,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598898,9 +601100,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599141,9 +601343,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599384,9 +601586,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599627,9 +601829,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599870,9 +602072,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600113,9 +602315,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600356,9 +602558,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600599,9 +602801,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600842,9 +603044,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601085,9 +603287,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601328,9 +603530,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601571,9 +603773,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601814,9 +604016,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602057,9 +604259,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602300,9 +604502,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602543,9 +604745,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602786,9 +604988,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603029,9 +605231,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603272,9 +605474,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603515,9 +605717,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603758,9 +605960,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604001,9 +606203,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604244,9 +606446,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604487,9 +606689,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604730,9 +606932,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604973,9 +607175,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605216,9 +607418,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605459,9 +607661,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605702,9 +607904,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605945,9 +608147,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606188,9 +608390,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606431,9 +608633,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606674,9 +608876,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606917,9 +609119,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607160,9 +609362,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607403,9 +609605,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607646,9 +609848,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607889,9 +610091,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608132,9 +610334,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608375,9 +610577,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608618,9 +610820,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608861,9 +611063,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609104,9 +611306,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609347,9 +611549,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609590,9 +611792,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609833,9 +612035,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610076,9 +612278,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610319,9 +612521,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610562,9 +612764,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610805,9 +613007,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611048,9 +613250,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611291,9 +613493,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611534,9 +613736,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611777,9 +613979,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -612020,9 +614222,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -612263,9 +614465,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -612506,9 +614708,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
@@ -612749,9 +614951,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 1,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {
             "techniqueID": "T1483",
diff --git a/docs/stories.md b/docs/stories.md
index 48a26e3989..7814b485da 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -119,8 +119,6 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 | ----------- | ----------- |--------------|
 | T1189 | Drive-by Compromise | Initial Access |
 | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
-| T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
-| T1071.001 | Web Protocols | Command and Control |
 
 #### Kill Chain Phase
 
@@ -429,7 +427,7 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1127](https://attack.mitre.org/techniques/T1127/), [T1127.001](https://attack.mitre.org/techniques/T1127.001/), [T1218.010](https://attack.mitre.org/techniques/T1218.010/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1560.001](https://attack.mitre.org/techniques/T1560.001/)
+- **ATT&CK**: [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059.003](https://attack.mitre.org/techniques/T1059.003/), [T1127](https://attack.mitre.org/techniques/T1127/), [T1127.001](https://attack.mitre.org/techniques/T1127.001/), [T1218.010](https://attack.mitre.org/techniques/T1218.010/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1543.003](https://attack.mitre.org/techniques/T1543.003/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1560.001](https://attack.mitre.org/techniques/T1560.001/)
 - **Last Updated**: 2021-02-16
 
 

@@ -439,6 +437,8 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 
 * [Anomalous usage of 7zip](detections.md#anomalous-usage-of-7zip)
 
+* [CMD Echo Pipe - Escalation](detections.md#cmd-echo-pipe---escalation)
+
 * [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
 
 * [DLLHost with no Command Line Arguments with Network](detections.md#dllhost-with-no-command-line-arguments-with-network)
@@ -475,15 +475,15 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1560.001 | Archive via Utility | Collection |
+| T1059.003 | Windows Command Shell | Execution |
+| T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1071.002 | File Transfer Protocols | Command and Control |
-| T1059.003 | Windows Command Shell | Execution |
 | T1218.010 | Regsvr32 | Defense Evasion |
 | T1218.005 | Mshta | Defense Evasion |
 | T1569.002 | Service Execution | Execution |
 | T1027 | Obfuscated Files or Information | Defense Evasion |
 | T1218.011 | Rundll32 | Defense Evasion |
-| T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
 | T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 | T1203 | Exploitation for Client Execution | Execution |
@@ -532,7 +532,7 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1036](https://attack.mitre.org/techniques/T1036/), [T1114.001](https://attack.mitre.org/techniques/T1114.001/), [T1114.002](https://attack.mitre.org/techniques/T1114.002/)
+- **ATT&CK**: [T1036](https://attack.mitre.org/techniques/T1036/), [T1114.001](https://attack.mitre.org/techniques/T1114.001/), [T1114.002](https://attack.mitre.org/techniques/T1114.002/), [T1560.001](https://attack.mitre.org/techniques/T1560.001/)
 - **Last Updated**: 2020-02-03
 
 

@@ -540,6 +540,10 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 #### Detection Profile
 
+* [Detect Renamed 7-Zip](detections.md#detect-renamed-7-zip)
+
+* [Detect Renamed WinRAR](detections.md#detect-renamed-winrar)
+
 * [Email files written outside of the Outlook directory](detections.md#email-files-written-outside-of-the-outlook-directory)
 
 * [Email servers sending high volume traffic to hosts](detections.md#email-servers-sending-high-volume-traffic-to-hosts)
@@ -555,6 +559,7 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
+| T1560.001 | Archive via Utility | Collection |
 | T1114.001 | Local Email Collection | Collection |
 | T1114.002 | Remote Email Collection | Collection |
 | T1036 | Masquerading | Defense Evasion |
@@ -563,6 +568,10 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 * Actions on Objectives
 
+* Exfiltration
+
+* Exploitation
+
 
 #### Reference
 
@@ -776,6 +785,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [Ntdsutil Export NTDS](detections.md#ntdsutil-export-ntds)
 
+* [SecretDumps Offline NTDS Dumping Tool](detections.md#secretdumps-offline-ntds-dumping-tool)
+
 * [Set Default PowerShell Execution Policy To Unrestricted or Bypass](detections.md#set-default-powershell-execution-policy-to-unrestricted-or-bypass)
 
 * [Unsigned Image Loaded by LSASS](detections.md#unsigned-image-loaded-by-lsass)
@@ -888,8 +899,8 @@ _version_: 1
 The stealing of data by an adversary.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: 
-- **ATT&CK**: [T1041](https://attack.mitre.org/techniques/T1041/), [T1114](https://attack.mitre.org/techniques/T1114/), [T1114.003](https://attack.mitre.org/techniques/T1114.003/)
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1041](https://attack.mitre.org/techniques/T1041/), [T1114](https://attack.mitre.org/techniques/T1114/), [T1114.001](https://attack.mitre.org/techniques/T1114.001/), [T1114.003](https://attack.mitre.org/techniques/T1114.003/)
 - **Last Updated**: 2020-10-21
 
 

@@ -899,6 +910,8 @@ The stealing of data by an adversary.
 
 * [Detect SNICat SNI Exfiltration](detections.md#detect-snicat-sni-exfiltration)
 
+* [Mailsniper Invoke functions](detections.md#mailsniper-invoke-functions)
+
 * [O365 PST export alert](detections.md#o365-pst-export-alert)
 
 * [O365 Suspicious Admin Email Forwarding](detections.md#o365-suspicious-admin-email-forwarding)
@@ -911,6 +924,7 @@ The stealing of data by an adversary.
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
+| T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
 
@@ -920,6 +934,8 @@ The stealing of data by an adversary.
 
 * Actions on Objectives
 
+* Exploitation
+
 
 #### Reference
 
@@ -1166,7 +1182,7 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.003](https://attack.mitre.org/techniques/T1003.003/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1114.002](https://attack.mitre.org/techniques/T1114.002/), [T1136.001](https://attack.mitre.org/techniques/T1136.001/), [T1190](https://attack.mitre.org/techniques/T1190/), [T1505.003](https://attack.mitre.org/techniques/T1505.003/)
+- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.003](https://attack.mitre.org/techniques/T1003.003/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1114.002](https://attack.mitre.org/techniques/T1114.002/), [T1136.001](https://attack.mitre.org/techniques/T1136.001/), [T1190](https://attack.mitre.org/techniques/T1190/), [T1505.003](https://attack.mitre.org/techniques/T1505.003/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2021-03-03
 
 

@@ -1182,6 +1198,8 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 * [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
 
+* [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
+
 * [Dump LSASS via comsvcs DLL](detections.md#dump-lsass-via-comsvcs-dll)
 
 * [Dump LSASS via procdump](detections.md#dump-lsass-via-procdump)
@@ -1213,6 +1231,7 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 | T1505.003 | Web Shell | Persistence |
 | T1136.001 | Local Account | Persistence |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1569.002 | Service Execution | Execution |
 | T1003.001 | LSASS Memory | Credential Access |
 | T1114.002 | Remote Email Collection | Collection |
 | T1003.003 | NTDS | Credential Access |
@@ -1224,10 +1243,14 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 * Command and Control
 
+* Execution
+
 * Exploitation
 
 * Installation
 
+* Lateral Movement
+
 
 #### Reference
 
@@ -1313,7 +1336,7 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1550.002](https://attack.mitre.org/techniques/T1550.002/), [T1558.003](https://attack.mitre.org/techniques/T1558.003/)
+- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1550.002](https://attack.mitre.org/techniques/T1550.002/), [T1558.003](https://attack.mitre.org/techniques/T1558.003/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2020-02-04
 
 

@@ -1325,6 +1348,10 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * [Detect Pass the Hash](detections.md#detect-pass-the-hash)
 
+* [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
+
+* [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
+
 * [Kerberoasting spn request with RC4 encryption](detections.md#kerberoasting-spn-request-with-rc4-encryption)
 
 * [Remote Desktop Network Traffic](detections.md#remote-desktop-network-traffic)
@@ -1339,6 +1366,8 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1550.002 | Pass the Hash | Defense Evasion, Lateral Movement |
+| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1569.002 | Service Execution | Execution |
 | T1558.003 | Kerberoasting | Credential Access |
 | T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
@@ -1347,6 +1376,12 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * Actions on Objectives
 
+* Execution
+
+* Exploitation
+
+* Lateral Movement
+
 
 #### Reference
 
@@ -1496,6 +1531,47 @@ Adversaries may rename legitimate system utilities to try to evade security mech
 * https://attack.mitre.org/techniques/T1036/003/
 
 
+_version_: 1
+

+
+---
+
+### Meterpreter
+Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1033](https://attack.mitre.org/techniques/T1033/)
+- **Last Updated**: 2021-06-08
+
+

+  details
+
+#### Detection Profile
+
+* [Excessive number of taskhost processes](detections.md#excessive-number-of-taskhost-processes)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1033 | System Owner/User Discovery | Discovery |
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Reference
+
+* https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
+
+* https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/
+
+* https://www.rapid7.com/products/metasploit/
+
+
 _version_: 1
 

 
@@ -1546,15 +1622,15 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1560.001 | Archive via Utility | Collection |
+| T1059.003 | Windows Command Shell | Execution |
+| T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
 | T1071.002 | File Transfer Protocols | Command and Control |
-| T1059.003 | Windows Command Shell | Execution |
 | T1218.010 | Regsvr32 | Defense Evasion |
 | T1218.005 | Mshta | Defense Evasion |
 | T1569.002 | Service Execution | Execution |
 | T1027 | Obfuscated Files or Information | Defense Evasion |
 | T1218.011 | Rundll32 | Defense Evasion |
-| T1543.003 | Windows Service | Persistence, Privilege Escalation |
 | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation |
 | T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 | T1203 | Exploitation for Client Execution | Execution |
@@ -2670,7 +2746,7 @@ _version_: 1
 ### Windows Discovery Techniques
 Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.
 
-- **Product**: Splunk Behavioral Analytics
+- **Product**: Splunk Behavioral Analytics, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
 - **ATT&CK**: [T1007](https://attack.mitre.org/techniques/T1007/), [T1012](https://attack.mitre.org/techniques/T1012/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1039](https://attack.mitre.org/techniques/T1039/), [T1046](https://attack.mitre.org/techniques/T1046/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1057](https://attack.mitre.org/techniques/T1057/), [T1068](https://attack.mitre.org/techniques/T1068/), [T1078](https://attack.mitre.org/techniques/T1078/), [T1083](https://attack.mitre.org/techniques/T1083/), [T1087](https://attack.mitre.org/techniques/T1087/), [T1098](https://attack.mitre.org/techniques/T1098/), [T1135](https://attack.mitre.org/techniques/T1135/), [T1199](https://attack.mitre.org/techniques/T1199/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1484](https://attack.mitre.org/techniques/T1484/), [T1518](https://attack.mitre.org/techniques/T1518/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1547](https://attack.mitre.org/techniques/T1547/), [T1574](https://attack.mitre.org/techniques/T1574/), [T1589.001](https://attack.mitre.org/techniques/T1589.001/), [T1590](https://attack.mitre.org/techniques/T1590/), [T1590.001](https://attack.mitre.org/techniques/T1590.001/), [T1590.003](https://attack.mitre.org/techniques/T1590.003/), [T1591](https://attack.mitre.org/techniques/T1591/), [T1592](https://attack.mitre.org/techniques/T1592/), [T1592.002](https://attack.mitre.org/techniques/T1592.002/), [T1595](https://attack.mitre.org/techniques/T1595/), [T1595.002](https://attack.mitre.org/techniques/T1595.002/)
 - **Last Updated**: 2021-03-04
@@ -2758,6 +2834,8 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 
 * https://cyberd.us/penetration-testing
 
+* https://attack.mitre.org/software/S0521/
+
 
 _version_: 1
 

@@ -3149,8 +3227,8 @@ _version_: 1
 Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Network_Resolution, Network_Traffic
-- **ATT&CK**: [T1048](https://attack.mitre.org/techniques/T1048/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1189](https://attack.mitre.org/techniques/T1189/)
+- **Datamodel**: Endpoint, Network_Resolution, Network_Traffic
+- **ATT&CK**: [T1021](https://attack.mitre.org/techniques/T1021/), [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1189](https://attack.mitre.org/techniques/T1189/)
 - **Last Updated**: 2017-09-11
 
 

@@ -3158,8 +3236,14 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 #### Detection Profile
 
+* [Allow Inbound Traffic By Firewall Rule Registry](detections.md#allow-inbound-traffic-by-firewall-rule-registry)
+
+* [Allow Inbound Traffic In Firewall Rule](detections.md#allow-inbound-traffic-in-firewall-rule)
+
 * [Detect hosts connecting to dynamic domain providers](detections.md#detect-hosts-connecting-to-dynamic-domain-providers)
 
+* [Enable RDP In Other Port Number](detections.md#enable-rdp-in-other-port-number)
+
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
 
 * [Protocol or Port Mismatch](detections.md#protocol-or-port-mismatch)
@@ -3171,9 +3255,11 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
+| T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1189 | Drive-by Compromise | Initial Access |
-| T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
+| T1021 | Remote Services | Lateral Movement |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
+| T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |
 | T1071.001 | Web Protocols | Command and Control |
 
 #### Kill Chain Phase
@@ -3184,6 +3270,8 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 * Delivery
 
+* Exploitation
+
 
 #### Reference
 
@@ -4615,7 +4703,7 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1059.003](https://attack.mitre.org/techniques/T1059.003/), [T1071.002](https://attack.mitre.org/techniques/T1071.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1136.001](https://attack.mitre.org/techniques/T1136.001/), [T1204.002](https://attack.mitre.org/techniques/T1204.002/), [T1543.003](https://attack.mitre.org/techniques/T1543.003/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1562.004](https://attack.mitre.org/techniques/T1562.004/)
+- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1059.003](https://attack.mitre.org/techniques/T1059.003/), [T1071.002](https://attack.mitre.org/techniques/T1071.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1136.001](https://attack.mitre.org/techniques/T1136.001/), [T1204.002](https://attack.mitre.org/techniques/T1204.002/), [T1543.003](https://attack.mitre.org/techniques/T1543.003/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1562.004](https://attack.mitre.org/techniques/T1562.004/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2020-01-22
 
 

@@ -4631,6 +4719,8 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
 
+* [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
+
 * [First time seen command line argument](detections.md#first-time-seen-command-line-argument)
 
 * [Malicious PowerShell Process - Execution Policy Bypass](detections.md#malicious-powershell-process---execution-policy-bypass)
@@ -4659,6 +4749,7 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 | T1136.001 | Local Account | Persistence |
 | T1071.002 | File Transfer Protocols | Command and Control |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1569.002 | Service Execution | Execution |
 | T1059.001 | PowerShell | Execution |
 | T1059.003 | Windows Command Shell | Execution |
 | T1562.004 | Disable or Modify System Firewall | Defense Evasion |
@@ -4674,8 +4765,14 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * Command and Control
 
+* Execution
+
+* Exploitation
+
 * Installation
 
+* Lateral Movement
+
 
 #### Reference
 
@@ -4692,7 +4789,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1548.002](https://attack.mitre.org/techniques/T1548.002/)
+- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1548.002](https://attack.mitre.org/techniques/T1548.002/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2021-05-12
 
 

@@ -4720,6 +4817,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
 
+* [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
+
 * [Detect Renamed RClone](detections.md#detect-renamed-rclone)
 
 * [Extract SAM from Registry](detections.md#extract-sam-from-registry)
@@ -4744,6 +4843,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1003.001 | LSASS Memory | Credential Access |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
 | T1020 | Automated Exfiltration | Exfiltration |
+| T1569.002 | Service Execution | Execution |
 | T1486 | Data Encrypted for Impact | Impact |
 | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
 
@@ -4751,10 +4851,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Actions on Objectives
 
+* Execution
+
 * Exfiltration
 
 * Exploitation
 
+* Lateral Movement
+
 * Obfuscation
 
 
@@ -5019,7 +5123,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
+- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
 - **Last Updated**: 2020-02-04
 
 

@@ -5035,18 +5139,36 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Common Ransomware Notes](detections.md#common-ransomware-notes)
 
+* [Conti Common Exec parameter](detections.md#conti-common-exec-parameter)
+
+* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
+
 * [Deleting Shadow Copies](detections.md#deleting-shadow-copies)
 
 * [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
 
 * [Detect Renamed RClone](detections.md#detect-renamed-rclone)
 
+* [Detect SharpHound Command-Line Arguments](detections.md#detect-sharphound-command-line-arguments)
+
+* [Detect SharpHound File Modifications](detections.md#detect-sharphound-file-modifications)
+
+* [Detect SharpHound Usage](detections.md#detect-sharphound-usage)
+
+* [Known Services Killed by Ransomware](detections.md#known-services-killed-by-ransomware)
+
+* [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
+
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
 
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [Remote Process Instantiation via WMI](detections.md#remote-process-instantiation-via-wmi)
 
+* [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
+
+* [Revil Registry Entry](detections.md#revil-registry-entry)
+
 * [SMB Traffic Spike](detections.md#smb-traffic-spike)
 
 * [SMB Traffic Spike - MLTK](detections.md#smb-traffic-spike---mltk)
@@ -5073,6 +5195,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [WBAdmin Delete System Backups](detections.md#wbadmin-delete-system-backups)
 
+* [Wbemprox COM Object Execution](detections.md#wbemprox-com-object-execution)
+
 * [WinEvent Scheduled Task Created Within Public Path](detections.md#winevent-scheduled-task-created-within-public-path)
 
 * [WinEvent Scheduled Task Created to Spawn Shell](detections.md#winevent-scheduled-task-created-to-spawn-shell)
@@ -5087,12 +5211,19 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1490 | Inhibit System Recovery | Impact |
 | T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1204 | User Execution | Execution |
 | T1020 | Automated Exfiltration | Exfiltration |
+| T1087.002 | Domain Account | Discovery |
+| T1087.001 | Local Account | Discovery |
 | T1482 | Domain Trust Discovery | Discovery |
+| T1069.002 | Domain Groups | Discovery |
+| T1069.001 | Local Groups | Discovery |
+| T1491 | Defacement | Impact |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
 | T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1047 | Windows Management Instrumentation | Execution |
+| T1112 | Modify Registry | Defense Evasion |
 | T1486 | Data Encrypted for Impact | Impact |
 | T1059.003 | Windows Command Shell | Execution |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
@@ -5118,6 +5249,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Privilege Escalation
 
+* Reconnaissance
+
 
 #### Reference
 
@@ -5167,6 +5300,57 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://www.youtube.com/watch?v=PgzNib37g0M
 
 
+_version_: 1
+

+
+---
+
+### Revil Ransomware
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/)
+- **Last Updated**: 2021-06-04
+
+

+  details
+
+#### Detection Profile
+
+* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
+
+* [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
+
+* [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
+
+* [Revil Registry Entry](detections.md#revil-registry-entry)
+
+* [Wbemprox COM Object Execution](detections.md#wbemprox-com-object-execution)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1490 | Inhibit System Recovery | Impact |
+| T1491 | Defacement | Impact |
+| T1204 | User Execution | Execution |
+| T1112 | Modify Registry | Defense Evasion |
+| T1218.003 | CMSTP | Defense Evasion |
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Reference
+
+* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+
+* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+
+
 _version_: 1
 

 
@@ -5225,12 +5409,19 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1490 | Inhibit System Recovery | Impact |
 | T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1204 | User Execution | Execution |
 | T1020 | Automated Exfiltration | Exfiltration |
+| T1087.002 | Domain Account | Discovery |
+| T1087.001 | Local Account | Discovery |
 | T1482 | Domain Trust Discovery | Discovery |
+| T1069.002 | Domain Groups | Discovery |
+| T1069.001 | Local Groups | Discovery |
+| T1491 | Defacement | Impact |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
 | T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1047 | Windows Management Instrumentation | Execution |
+| T1112 | Modify Registry | Defense Evasion |
 | T1486 | Data Encrypted for Impact | Impact |
 | T1059.003 | Windows Command Shell | Execution |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
@@ -5276,7 +5467,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic, Web
-- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1082](https://attack.mitre.org/techniques/T1082/), [T1204.002](https://attack.mitre.org/techniques/T1204.002/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/)
+- **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1082](https://attack.mitre.org/techniques/T1082/), [T1204.002](https://attack.mitre.org/techniques/T1204.002/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2018-12-13
 
 

@@ -5294,6 +5485,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
 
+* [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
+
 * [Detect attackers scanning for vulnerable JBoss servers](detections.md#detect-attackers-scanning-for-vulnerable-jboss-servers)
 
 * [Detect malicious requests to exploit JBoss servers](detections.md#detect-malicious-requests-to-exploit-jboss-servers)
@@ -5319,6 +5512,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1485 | Data Destruction | Impact |
 | T1490 | Inhibit System Recovery | Impact |
 | T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1569.002 | Service Execution | Execution |
 | T1082 | System Information Discovery | Discovery |
 | T1021.001 | Remote Desktop Protocol | Lateral Movement |
 | T1486 | Data Encrypted for Impact | Impact |
@@ -5331,8 +5525,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Delivery
 
+* Execution
+
+* Exploitation
+
 * Installation
 
+* Lateral Movement
+
 * Reconnaissance
 
 
diff --git a/docs/stories.wiki b/docs/stories.wiki
index bf18852fec..aefa6fba91 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -102,7 +102,7 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Change_Analysis, Network_Resolution
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1048.003/ T1048.003]
 * '''Last Updated''': 2017-09-14
 
 

@@ -131,14 +131,6 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 | T1048.003
 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
 | Exfiltration
-|-
-| T1048
-| Exfiltration Over Alternative Protocol
-| Exfiltration
-|-
-| T1071.001
-| Web Protocols
-| Command and Control
 |}
 
 
@@ -518,7 +510,7 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
 * '''Last Updated''': 2021-02-16
 
 

@@ -528,6 +520,8 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 
 * [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
 
+* [[Documentation:ESSOC:detections:Detections#Cmd_echo_pipe_-_escalation|CMD Echo Pipe - Escalation]]
+
 * [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
 
 * [[Documentation:ESSOC:detections:Detections#Dllhost_with_no_command_line_arguments_with_network|DLLHost with no Command Line Arguments with Network]]
@@ -570,6 +564,14 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | Archive via Utility
 | Collection
 |-
+| T1059.003
+| Windows Command Shell
+| Execution
+|-
+| T1543.003
+| Windows Service
+| Persistence, Privilege Escalation
+|-
 | T1055
 | Process Injection
 | Defense Evasion, Privilege Escalation
@@ -578,10 +580,6 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | File Transfer Protocols
 | Command and Control
 |-
-| T1059.003
-| Windows Command Shell
-| Execution
-|-
 | T1218.010
 | Regsvr32
 | Defense Evasion
@@ -602,10 +600,6 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | Rundll32
 | Defense Evasion
 |-
-| T1543.003
-| Windows Service
-| Persistence, Privilege Escalation
-|-
 | T1053.005
 | Scheduled Task
 | Execution, Persistence, Privilege Escalation
@@ -683,7 +677,7 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1036/ T1036]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1036/ T1036]
 * '''Last Updated''': 2020-02-03
 
 

@@ -691,6 +685,10 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_7-zip|Detect Renamed 7-Zip]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_winrar|Detect Renamed WinRAR]]
+
 * [[Documentation:ESSOC:detections:Detections#Email_files_written_outside_of_the_outlook_directory|Email files written outside of the Outlook directory]]
 
 * [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
@@ -709,6 +707,10 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 ! Technique
 ! Tactic
 |-
+| T1560.001
+| Archive via Utility
+| Collection
+|-
 | T1114.001
 | Local Email Collection
 | Collection
@@ -727,6 +729,10 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 * Actions on Objectives
 
+* Exfiltration
+
+* Exploitation
+
 
 ====Reference====
 
@@ -972,6 +978,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
+* [[Documentation:ESSOC:detections:Detections#Secretdumps_offline_ntds_dumping_tool|SecretDumps Offline NTDS Dumping Tool]]
+
 * [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
 
 * [[Documentation:ESSOC:detections:Detections#Unsigned_image_loaded_by_lsass|Unsigned Image Loaded by LSASS]]
@@ -1175,8 +1183,8 @@ Secure your environment against DNS hijacks with searches that help you detect a
 The stealing of data by an adversary.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': 
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003]
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003]
 * '''Last Updated''': 2020-10-21
 
 

@@ -1186,6 +1194,8 @@ The stealing of data by an adversary.
 
 * [[Documentation:ESSOC:detections:Detections#Detect_snicat_sni_exfiltration|Detect SNICat SNI Exfiltration]]
 
+* [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]
+
 * [[Documentation:ESSOC:detections:Detections#O365_pst_export_alert|O365 PST export alert]]
 
 * [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]
@@ -1204,6 +1214,10 @@ The stealing of data by an adversary.
 | Exfiltration Over C2 Channel
 | Exfiltration
 |-
+| T1114.001
+| Local Email Collection
+| Collection
+|-
 | T1114
 | Email Collection
 | Collection
@@ -1220,6 +1234,8 @@ The stealing of data by an adversary.
 
 * Actions on Objectives
 
+* Exploitation
+
 
 ====Reference====
 
@@ -1528,7 +1544,7 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1190/ T1190]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1190/ T1190]
 * '''Last Updated''': 2021-03-03
 
 

@@ -1544,6 +1560,8 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 * [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
+
 * [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
 
 * [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]
@@ -1590,6 +1608,10 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 | SMB/Windows Admin Shares
 | Lateral Movement
 |-
+| T1569.002
+| Service Execution
+| Execution
+|-
 | T1003.001
 | LSASS Memory
 | Credential Access
@@ -1614,10 +1636,14 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 
 * Command and Control
 
+* Execution
+
 * Exploitation
 
 * Installation
 
+* Lateral Movement
+
 
 ====Reference====
 
@@ -1754,7 +1780,7 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1053.005/ T1053.005]
 * '''Last Updated''': 2020-02-04
 
 

@@ -1766,6 +1792,10 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * [[Documentation:ESSOC:detections:Detections#Detect_pass_the_hash|Detect Pass the Hash]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
+
 * [[Documentation:ESSOC:detections:Detections#Kerberoasting_spn_request_with_rc4_encryption|Kerberoasting spn request with RC4 encryption]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
@@ -1786,6 +1816,14 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 | Pass the Hash
 | Defense Evasion, Lateral Movement
 |-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|-
+| T1569.002
+| Service Execution
+| Execution
+|-
 | T1558.003
 | Kerberoasting
 | Credential Access
@@ -1804,6 +1842,12 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * Actions on Objectives
 
+* Execution
+
+* Exploitation
+
+* Lateral Movement
+
 
 ====Reference====
 
@@ -2026,6 +2070,55 @@ Adversaries may rename legitimate system utilities to try to evade security mech
 * https://attack.mitre.org/techniques/T1036/003/
 
 
+''version'': 1
+

+

+
+----
+
+===Meterpreter===
+Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1033/ T1033]
+* '''Last Updated''': 2021-06-08
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Excessive_number_of_taskhost_processes|Excessive number of taskhost processes]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1033
+| System Owner/User Discovery
+| Discovery
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Reference====
+
+* https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
+
+* https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/
+
+* https://www.rapid7.com/products/metasploit/
+
+
 ''version'': 1
 

 

@@ -2037,7 +2130,7 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic, Web
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
 * '''Last Updated''': 2020-12-14
 
 

@@ -2083,6 +2176,14 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | Archive via Utility
 | Collection
 |-
+| T1059.003
+| Windows Command Shell
+| Execution
+|-
+| T1543.003
+| Windows Service
+| Persistence, Privilege Escalation
+|-
 | T1055
 | Process Injection
 | Defense Evasion, Privilege Escalation
@@ -2091,10 +2192,6 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | File Transfer Protocols
 | Command and Control
 |-
-| T1059.003
-| Windows Command Shell
-| Execution
-|-
 | T1218.010
 | Regsvr32
 | Defense Evasion
@@ -2115,10 +2212,6 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | Rundll32
 | Defense Evasion
 |-
-| T1543.003
-| Windows Service
-| Persistence, Privilege Escalation
-|-
 | T1053.005
 | Scheduled Task
 | Execution, Persistence, Privilege Escalation
@@ -3540,7 +3633,7 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 ===Windows discovery techniques===
 Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.
 
-* '''Product''': Splunk Behavioral Analytics
+* '''Product''': Splunk Behavioral Analytics, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': 
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1484/ T1484], [https://attack.mitre.org/techniques/T1199/ T1199], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1591/ T1591], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1012/ T1012], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1057/ T1057], [https://attack.mitre.org/techniques/T1083/ T1083], [https://attack.mitre.org/techniques/T1518/ T1518], [https://attack.mitre.org/techniques/T1592.002/ T1592.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1574/ T1574], [https://attack.mitre.org/techniques/T1589.001/ T1589.001], [https://attack.mitre.org/techniques/T1590.001/ T1590.001], [https://attack.mitre.org/techniques/T1590.003/ T1590.003], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1595.002/ T1595.002], [https://attack.mitre.org/techniques/T1055/ T1055]
 * '''Last Updated''': 2021-03-04
@@ -3725,6 +3818,8 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 
 * https://cyberd.us/penetration-testing
 
+* https://attack.mitre.org/software/S0521/
+
 
 ''version'': 1
 

@@ -4210,8 +4305,8 @@ Monitor your enterprise to ensure that your endpoints are being patched and upda
 Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Network_Resolution, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2017-09-11
 
 

@@ -4219,8 +4314,14 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_by_firewall_rule_registry|Allow Inbound Traffic By Firewall Rule Registry]]
+
+* [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_in_firewall_rule|Allow Inbound Traffic In Firewall Rule]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
 
+* [[Documentation:ESSOC:detections:Detections#Enable_rdp_in_other_port_number|Enable RDP In Other Port Number]]
+
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
 
 * [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
@@ -4235,18 +4336,26 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 ! Technique
 ! Tactic
 |-
+| T1021.001
+| Remote Desktop Protocol
+| Lateral Movement
+|-
 | T1189
 | Drive-by Compromise
 | Initial Access
 |-
-| T1048.003
-| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
-| Exfiltration
+| T1021
+| Remote Services
+| Lateral Movement
 |-
 | T1048
 | Exfiltration Over Alternative Protocol
 | Exfiltration
 |-
+| T1048.003
+| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+| Exfiltration
+|-
 | T1071.001
 | Web Protocols
 | Command and Control
@@ -4261,6 +4370,8 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 * Delivery
 
+* Exploitation
+
 
 ====Reference====
 
@@ -5977,7 +6088,7 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1562.004/ T1562.004], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1112/ T1112]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1562.004/ T1562.004], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1112/ T1112]
 * '''Last Updated''': 2020-01-22
 
 

@@ -5993,6 +6104,8 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
+
 * [[Documentation:ESSOC:detections:Detections#First_time_seen_command_line_argument|First time seen command line argument]]
 
 * [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
@@ -6033,6 +6146,10 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 | SMB/Windows Admin Shares
 | Lateral Movement
 |-
+| T1569.002
+| Service Execution
+| Execution
+|-
 | T1059.001
 | PowerShell
 | Execution
@@ -6073,8 +6190,14 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * Command and Control
 
+* Execution
+
+* Exploitation
+
 * Installation
 
+* Lateral Movement
+
 
 ====Reference====
 
@@ -6092,7 +6215,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1548.002/ T1548.002]
 * '''Last Updated''': 2021-05-12
 
 

@@ -6120,6 +6243,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
 
 * [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
@@ -6174,6 +6299,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Automated Exfiltration
 | Exfiltration
 |-
+| T1569.002
+| Service Execution
+| Execution
+|-
 | T1486
 | Data Encrypted for Impact
 | Impact
@@ -6188,10 +6317,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Actions on Objectives
 
+* Execution
+
 * Exfiltration
 
 * Exploitation
 
+* Lateral Movement
+
 * Obfuscation
 
 
@@ -6549,7 +6682,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-02-04
 
 

@@ -6565,18 +6698,36 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
 
+* [[Documentation:ESSOC:detections:Detections#Conti_common_exec_parameter|Conti Common Exec parameter]]
+
+* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
+
 * [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_command-line_arguments|Detect SharpHound Command-Line Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_file_modifications|Detect SharpHound File Modifications]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_usage|Detect SharpHound Usage]]
+
+* [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]
+
+* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
+
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
 
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
 
+* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
+
+* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
+
 * [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
 
 * [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
@@ -6603,6 +6754,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Wbadmin_delete_system_backups|WBAdmin Delete System Backups]]
 
+* [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
+
 * [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 * [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
@@ -6629,14 +6782,38 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Data Destruction
 | Impact
 |-
+| T1204
+| User Execution
+| Execution
+|-
 | T1020
 | Automated Exfiltration
 | Exfiltration
 |-
+| T1087.002
+| Domain Account
+| Discovery
+|-
+| T1087.001
+| Local Account
+| Discovery
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
 |-
+| T1069.002
+| Domain Groups
+| Discovery
+|-
+| T1069.001
+| Local Groups
+| Discovery
+|-
+| T1491
+| Defacement
+| Impact
+|-
 | T1048
 | Exfiltration Over Alternative Protocol
 | Exfiltration
@@ -6653,6 +6830,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Windows Management Instrumentation
 | Execution
 |-
+| T1112
+| Modify Registry
+| Defense Evasion
+|-
 | T1486
 | Data Encrypted for Impact
 | Impact
@@ -6709,6 +6890,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Privilege Escalation
 
+* Reconnaissance
+
 
 ====Reference====
 
@@ -6766,6 +6949,77 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://www.youtube.com/watch?v=PgzNib37g0M
 
 
+''version'': 1
+

+

+
+----
+
+===Revil ransomware===
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
+* '''Last Updated''': 2021-06-04
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
+
+* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
+
+* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
+
+* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
+
+* [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1490
+| Inhibit System Recovery
+| Impact
+|-
+| T1491
+| Defacement
+| Impact
+|-
+| T1204
+| User Execution
+| Execution
+|-
+| T1112
+| Modify Registry
+| Defense Evasion
+|-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Reference====
+
+* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+
+* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+
+
 ''version'': 1
 

 

@@ -6777,7 +7031,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-11-06
 
 

@@ -6837,14 +7091,38 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Data Destruction
 | Impact
 |-
+| T1204
+| User Execution
+| Execution
+|-
 | T1020
 | Automated Exfiltration
 | Exfiltration
 |-
+| T1087.002
+| Domain Account
+| Discovery
+|-
+| T1087.001
+| Local Account
+| Discovery
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
 |-
+| T1069.002
+| Domain Groups
+| Discovery
+|-
+| T1069.001
+| Local Groups
+| Discovery
+|-
+| T1491
+| Defacement
+| Impact
+|-
 | T1048
 | Exfiltration Over Alternative Protocol
 | Exfiltration
@@ -6861,6 +7139,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Windows Management Instrumentation
 | Execution
 |-
+| T1112
+| Modify Registry
+| Defense Evasion
+|-
 | T1486
 | Data Encrypted for Impact
 | Impact
@@ -6938,7 +7220,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic, Web
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1486/ T1486]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1486/ T1486]
 * '''Last Updated''': 2018-12-13
 
 

@@ -6956,6 +7238,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_attackers_scanning_for_vulnerable_jboss_servers|Detect attackers scanning for vulnerable JBoss servers]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]
@@ -6996,6 +7280,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | SMB/Windows Admin Shares
 | Lateral Movement
 |-
+| T1569.002
+| Service Execution
+| Execution
+|-
 | T1082
 | System Information Discovery
 | Discovery
@@ -7018,8 +7306,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Delivery
 
+* Execution
+
+* Exploitation
+
 * Installation
 
+* Lateral Movement
+
 * Reconnaissance
 
 
@@ -7784,7 +8078,7 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-05-24 20:50:07.268835 UTC
+# On Date: 2021-06-10 18:37:22.207469 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############